EIP-2026-105378

This exploit demonstrates a blind SQL injection vulnerability in Bacula-web versions 1.3.x to 5.0.3, allowing an attacker to extract MySQL version information by leveraging unsanitized input in the 'server' parameter of report.php.