CVE-2023-52064
📋 TL;DR
Wuzhicms v4.1.0 contains a SQL injection vulnerability in the $keywords parameter at /core/admin/copyfrom.php. This allows attackers to execute arbitrary SQL commands on the database. All users running Wuzhicms v4.1.0 are affected.
💻 Affected Systems
- Wuzhicms
📦 What is this software?
Wuzhicms by Wuzhicms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or remote code execution via database functions.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions.
🎯 Exploit Status
Exploitation requires admin access or stolen credentials. SQL injection is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.1.1 or later
Vendor Advisory: https://github.com/wuzhicms/wuzhicms/issues/208
Restart Required: No
Instructions:
1. Download latest version from official repository. 2. Backup current installation. 3. Replace vulnerable files with patched versions. 4. Verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize $keywords parameter.
Modify /core/admin/copyfrom.php to validate/sanitize user input before SQL query.
Access Restriction
allRestrict access to vulnerable endpoint via web server configuration.
Add location block in nginx: location ~ /core/admin/copyfrom\.php { deny all; }
Add in Apache .htaccess: <Files "copyfrom.php"> Require all denied </Files>
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting /core/admin/copyfrom.php.
- Restrict database user permissions to minimum required operations.
🔍 How to Verify
Check if Vulnerable:
Check if running Wuzhicms v4.1.0 and if /core/admin/copyfrom.php exists.Check Version:
Check version.php file or admin dashboard for version number.Verify Fix Applied:
Verify version is v4.1.1 or later and test SQL injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin interface
- Requests to /core/admin/copyfrom.php with SQL keywords
Network Indicators:
- HTTP POST/GET requests to /core/admin/copyfrom.php containing SQL injection patterns
SIEM Query:
source="web_logs" AND uri="/core/admin/copyfrom.php" AND (keywords CONTAINS "UNION" OR keywords CONTAINS "SELECT" OR keywords CONTAINS "OR 1=1")