EIP-2026-109356

PRE-CVE

Max.Blog 1.0.6 - 'show_post.php' SQL Injection

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-109356. PoCs published by Salvatore Fresta.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Max.Blog <= 1.0.6, allowing unauthenticated attackers to extract admin credentials via a crafted UNION-based SQL query in the 'id' parameter of show_post.php.

Description

Max.Blog 1.0.6 - 'show_post.php' SQL Injection

Exploits (1)

exploitdb WORKING POC VERIFIED

by Salvatore Fresta · textwebappsphp

https://www.exploit-db.com/exploits/7885

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in Max.Blog <= 1.0.6, allowing unauthenticated attackers to extract admin credentials via a crafted UNION-based SQL query in the 'id' parameter of show_post.php.

Classification

Working Poc 95%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: Max.Blog <= 1.0.6

No auth needed

Prerequisites: Target running Max.Blog <= 1.0.6 · Access to show_post.php endpoint

MITRE ATT&CK

T1189 - Drive-by Compromise T1505 - Server Software Component

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026