EIP-2026-107147

PRE-CVE

FlexCMS 2.5 - 'CookieUsername' Cookie SQL Injection

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-107147. PoCs published by Inj3ct0r.

AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in FlexCMS by providing malformed input strings that manipulate SQL queries. The payloads bypass authentication by injecting conditions that always evaluate to true or false.

Description

FlexCMS 2.5 - 'CookieUsername' Cookie SQL Injection

Exploits (1)

exploitdb WORKING POC VERIFIED

by Inj3ct0r · textwebappsphp

https://www.exploit-db.com/exploits/33191

View Code ZIP pw:eip

This exploit demonstrates an SQL injection vulnerability in FlexCMS by providing malformed input strings that manipulate SQL queries. The payloads bypass authentication by injecting conditions that always evaluate to true or false.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: FlexCMS 2.5 and prior versions

No auth needed

Prerequisites: Access to the login page of FlexCMS

MITRE ATT&CK

T1189 - Drive-by Compromise T1505 - Server Software Component

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026