EIP-2026-104309

This exploit demonstrates a SQL injection vulnerability in LocatePC 1.05, allowing arbitrary SELECT queries against the LocatePC and 'mysql' databases. The PoC sends a maliciously crafted XML request to the API endpoint, extracting sensitive user data such as usernames, MAC addresses, and last login IPs.