EIP-2026-106652

PRE-CVE

E-Xoopport 3.1 - 'display.php?katid' SQL Injection

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-106652. PoCs published by Vis Intelligendi.

AI-analyzed exploit summary This PHP script exploits a SQL injection vulnerability in E-Xooport 3.1's eCal module to extract user data, including usernames and password hashes. It supports brute-forcing table names if the default table name is incorrect.

Description

E-Xoopport 3.1 - 'display.php?katid' SQL Injection

Exploits (1)

exploitdb WORKING POC
by Vis Intelligendi · phpwebappsphp
https://www.exploit-db.com/exploits/15492

This PHP script exploits a SQL injection vulnerability in E-Xooport 3.1's eCal module to extract user data, including usernames and password hashes. It supports brute-forcing table names if the default table name is incorrect.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: E-Xooport 3.1 (eCal module)
No auth needed
Prerequisites: Target must have E-Xooport 3.1 with the eCal module installed · SQL injection vulnerability must be unpatched
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026