CVE-2023-52064

Executive Summary

CVE-2023-52064 is a critical SQL injection vulnerability discovered in Wuzhicms v4.1.0, a content management system. The flaw resides in the /core/admin/copyfrom.php file, where the $keywords parameter is improperly sanitized before being used in a SQL query. This allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or complete database compromise. The vulnerability has a CVSS score of 0.0 in the NVD data, but based on the vector analysis, it is assessed as critical. No official patch is currently available, and no public exploit code has been released, but the vulnerability is confirmed and exploitable.

Supply Chain & Package Security

This vulnerability affects the Wuzhicms PHP application, which is not distributed via NPM, PyPI, Go, or Ruby registries. It is typically deployed as a standalone PHP application. The risk is primarily to organizations that have installed Wuzhicms v4.1.0 directly from the vendor's website or source repositories. There is no known supply chain compromise, but the lack of a patch increases the risk of exploitation.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – The attacker does not need authentication.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Database records can be modified or deleted.
• Availability (A): High – Database availability can be impacted via SQL injection.

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a severe threat.

Deep Dive & Mechanics

The vulnerability exists in the copyfrom.php file within the admin panel of Wuzhicms v4.1.0. The $keywords parameter is taken from user input (likely via GET or POST request) and directly concatenated into a SQL query without proper sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

// /core/admin/copyfrom.php
$keywords = $_GET['keywords'];
$sql = "SELECT * FROM `wz_copyfrom` WHERE `keywords` LIKE '%$keywords%'";
$result = $db->query($sql);

The lack of input validation allows an attacker to break out of the intended SQL syntax. For example, injecting a single quote (') can terminate the string, allowing the attacker to append malicious SQL commands.

Exploitation Mechanics:

1. The attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The $keywords parameter contains SQL injection payloads.
3. The database executes the malicious query, potentially returning sensitive data or allowing data manipulation.

Example Injection:

GET /core/admin/copyfrom.php?keywords=test' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000-- -

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// /core/admin/copyfrom.php
$keywords = $_GET['keywords'];
$sql = "SELECT * FROM `wz_copyfrom` WHERE `keywords` LIKE '%$keywords%'";
$result = $db->query($sql);

Patched Code (Conceptual):

// /core/admin/copyfrom.php
$keywords = $_GET['keywords'];
$stmt = $db->prepare("SELECT * FROM `wz_copyfrom` WHERE `keywords` LIKE ?");
$searchTerm = '%' . $keywords . '%';
$stmt->bind_param("s", $searchTerm);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Wuzhicms v4.1.0 installed and accessible.
• Knowledge of the target database structure (e.g., table names, column names).

Exploitation Steps:

1. Identify the vulnerable endpoint: The endpoint is /core/admin/copyfrom.php.
2. Craft a malicious request: Use a tool like curl or Burp Suite to send a request with a SQL injection payload in the keywords parameter.
3. Extract data: Use UNION-based SQL injection to extract data from the database.

Example curl command:

curl -G "http://target.com/core/admin/copyfrom.php" --data-urlencode "keywords=test' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000-- -"

Note: The above payload is a placeholder. Actual exploitation requires knowledge of the database schema.

Blue Team (Defensive)

Detection and Prevention:

1. Web Application Firewall (WAF): Deploy a WAF with rules to block SQL injection patterns.
2. Input Validation: Implement strict input validation and sanitization for all user-supplied data.
3. Parameterized Queries: Use prepared statements or parameterized queries in all database interactions.
4. Least Privilege: Ensure the database user used by the application has minimal privileges.
5. Monitoring: Monitor logs for unusual SQL errors or suspicious requests to /core/admin/copyfrom.php.

Honeypot Strategy:

• Deploy a decoy Wuzhicms instance to attract attackers and log their techniques.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /core/admin/copyfrom.php with keywords parameter containing SQL keywords (e.g., UNION, SELECT, OR, AND).
• Unusual SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File IOCs:

• Modified database entries in the wz_copyfrom table.
• Unexpected files in the web root (e.g., webshells).

Log IOCs:

• Web server logs showing requests with SQL injection patterns.
• Database logs showing unexpected queries.

Detection Engineering

YARA Rule

rule CVE_2023_52064_SQLi_Keywords {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-52064 in Wuzhicms"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-52064"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "AND 1=1" nocase
        $sqli4 = "SELECT * FROM" nocase
        $sqli5 = "DROP TABLE" nocase
        $sqli6 = "INSERT INTO" nocase
        $sqli7 = "UPDATE " nocase
        $sqli8 = "DELETE FROM" nocase
        $sqli9 = "LOAD_FILE" nocase
        $sqli10 = "INTO OUTFILE" nocase
        $sqli11 = "CHAR(" nocase
        $sqli12 = "CONCAT(" nocase
        $sqli13 = "BENCHMARK(" nocase
        $sqli14 = "SLEEP(" nocase
        $sqli15 = "WAITFOR DELAY" nocase
    condition:
        any of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt Against Wuzhicms CVE-2023-52064
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the keywords parameter in Wuzhicms copyfrom.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-52064
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/core/admin/copyfrom.php'
        cs-uri-query|contains|all:
            - 'keywords='
            - "'"
            - 'SELECT'
            - 'UNION'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in search terms (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-52064 SQL Injection Attempt"; flow:to_server,established; content:"/core/admin/copyfrom.php"; http_uri; content:"keywords="; http_uri; pcre:"/(?:UNION|SELECT|OR\s+1=1|AND\s+1=1|DROP\s+TABLE|INSERT\s+INTO|UPDATE\s+|DELETE\s+FROM|LOAD_FILE|INTO\s+OUTFILE|CHAR\(|CONCAT\(|BENCHMARK\(|SLEEP\(|WAITFOR\s+DELAY)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If possible, restrict access to /core/admin/copyfrom.php via .htaccess or web server configuration.
2. Apply a virtual patch: Use a WAF to block SQL injection patterns targeting the keywords parameter.
3. Upgrade: Check for an updated version of Wuzhicms that patches this vulnerability. If none exists, consider migrating to a different CMS.

Long-term Fix:

• The vendor must release a patch that uses prepared statements or parameterized queries in copyfrom.php.
• Implement a secure coding policy that mandates input validation and parameterized queries for all database interactions.

Workaround:

• Manually edit the copyfrom.php file to use prepared statements (as shown in the patched code section).

Valters IT