EIP-2026-108644

The exploit demonstrates an SQL injection vulnerability in the EXP Shop component for Joomla! by injecting a UNION-based query to extract user credentials from the database. The attack leverages unsanitized input in the 'catid' parameter to execute arbitrary SQL commands.