EIP-2026-106152

This PHP script exploits a blind SQL injection vulnerability in Contrexx Shopsystem by injecting crafted SQL queries into the 'catId' parameter. It extracts admin usernames and password hashes by brute-forcing character by character.