Trex96

GitHub · Repository owner · Source ID 95542691
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

Trex96/vulnerable-bsr-lab-CVE-2023-6933

Repository PoC0Created 2025-09-22ScannerCVE-2023-69336 files

28.9 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Nuclei template and supporting documentation that detects the presence of the vulnerable Better Search Replace plugin (CVE-2023-6933) and verifies the PHP object injection vulnerability by sending a safe serialized payload and analyzing the HTTP response. It does not execute arbitrary code or exploit the vulnerability for impact.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of documentation and a Nuclei template for CVE-2023-6933. The template sends a harmless stdClass serialized object with payload withheld to a known vulnerable endpoint. No concealed executable behavior, persistence, credential theft, or unrelated payload is present. The artifact demonstrates the claimed PHP Object Injection vulnerability without backdoor or deceptive harm.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesYAMLMarkdown
Target softwareBetter Search Replace WordPress Plugin
Attack typesPHP Object InjectionDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Nuclei template (cve-2023-6933.yaml) that sends HTTP requests to detect the plugin and verify the deserialization vulnerability by analyzing responses. It uses a safe stdClass payload and payload withheld to avoid exploitation. The documentation explicitly states it is a 'non-intrusive' 'Proof-of-Concept' for 'verification' and 'detection', not for achieving code execution or data impact. This matches the definition of a scanner.

CVE-2023-6933_POC_DOCUMENTATION.md:80-82CVE-2023-6933_POC_DOCUMENTATION.md:97-102nuclei-templates/cve-2023-6933.yaml:1-115

Requirements

  • Target must have Better Search Replace plugin version <= 1.4.4 installed.nuclei-templates/cve-2023-6933.yaml:53
  • The WordPress admin-ajax.php endpoint must be accessible.nuclei-templates/cve-2023-6933.yaml:72

Observed behavior

  • Sends a GET request to the plugin's README.txt to detect the plugin and extract its version.nuclei-templates/cve-2023-6933.yaml:38-40
  • Sends a POST request to admin-ajax.php with a serialized stdClass object in the search_for parameter and payload withheld to trigger the vulnerable unserialize call without modifying the database.nuclei-templates/cve-2023-6933.yaml:70-80
  • Matches HTTP response status codes 400, 403, or 500, a body containing '0', and non-empty body with specific content types to confirm the vulnerability.nuclei-templates/cve-2023-6933.yaml:84-101
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Serialized Payload
Payload withheldThe Nuclei template sends a harmless stdClass object with payload withheld to demonstrate deserialization without destructive effects.nuclei-templates/cve-2023-6933.yaml:35nuclei-templates/cve-2023-6933.yaml:80
Safety Parameter
Payload withheldThe POST body includes payload withheld, which prevents database modifications during testing.nuclei-templates/cve-2023-6933.yaml:80
Review boundaries

What the analysis did not establish

  • The evidence includes only the Nuclei template and documentation; the referenced PHP exploit scripts (cve_2023_6933_exploit.php, wp_html_token_poc.php, bsr_direct_exploit.php) and manual-test.sh are not provided in the selected text, so their content cannot be analyzed.
  • The analysis is based solely on the supplied text files; no code was executed, and the actual behavior of the template against a live target is not verified.
  • Three files (binary or non-text) were flagged as metadata-only and not analyzed; their content could not be reviewed.
  • The review is limited to the supplied text evidence; no runtime behavior was observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.