EIP-2026-105358

This exploit demonstrates multiple SQL injection vulnerabilities in b2ePMS 1.0, particularly in the unauthenticated message form on index.php. It includes a PoC payload and sqlmap output confirming error-based SQLi in the 'phone_number' parameter.