EIP-2026-109226

The exploit demonstrates a CSRF vulnerability and a blind SQL injection in LuxCal v3.2.2. The CSRF PoC shows how an attacker can add a new admin user via a crafted form submission, while the SQLi PoC uses time-based techniques to confirm the vulnerability.