EIP-2026-109356

This exploit demonstrates a SQL injection vulnerability in Max.Blog <= 1.0.6, allowing unauthenticated attackers to extract admin credentials via a crafted UNION-based SQL query in the 'id' parameter of show_post.php.