EIP-2026-107570

This exploit demonstrates a SQL injection vulnerability in Heaven Soft CMS 4.7, specifically in the 'photogallery_show.php' script. The PoC uses a UNION-based SQLi to extract user credentials from the 'user_profile' table.