Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-104842. PoCs published by 0x4148.
AI-analyzed exploit summary The exploit demonstrates a SQL injection vulnerability in 4images <= 1.7.13 via the 'orderby' parameter in admin/validateimages.php, which can be escalated to execute arbitrary JavaScript in the admin's browser session, leading to CSRF token bypass and administrator account addition.
Description
4Images 1.7.13 - SQL Injection
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by 0x4148 · textwebappsphp
https://www.exploit-db.com/exploits/40750
The exploit demonstrates a SQL injection vulnerability in 4images <= 1.7.13 via the 'orderby' parameter in admin/validateimages.php, which can be escalated to execute arbitrary JavaScript in the admin's browser session, leading to CSRF token bypass and administrator account addition.
Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target:
4images <= 1.7.13
Auth required
Prerequisites:
Valid user account · Image upload permissions · Admin session active
devstral-2 · analyzed Feb 18, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026