EIP-2026-109357

This is a technical writeup detailing a SQL injection vulnerability in Max.Blog <= 1.0.6. The vulnerability allows a registered user to extract admin credentials via a crafted UNION-based SQL injection in the 'draft' parameter of submit_post.php when magic quotes are disabled.