EIP-2026-108156

The exploit demonstrates an SQL injection vulnerability in the Joomla! and Mambo 'com_smslist' component by injecting a UNION-based SQL query to extract user credentials from the 'mos_users' table. The attack leverages unsanitized input in the 'listid' parameter to manipulate the SQL query.