EIP-2026-106945

The exploit demonstrates a SQL injection vulnerability in eVision CMS <= 2.0, where user-controlled input via the 'field', 'module', and 'id' GET parameters is directly interpolated into a SQL query without sanitization. This allows an attacker to retrieve sensitive data, such as the admin's hashed password, by crafting a malicious request.