EIP-2026-105565

The exploit demonstrates a SQL injection vulnerability in BM Classifieds 1.3 via the 'cat' parameter in 'classifieds.php'. It allows an attacker to extract user credentials (username, password) from the 'users' table using a UNION-based SQLi.