EIP-2026-109460

The exploit demonstrates an SQL injection vulnerability in MidiCart PHP by injecting a UNION SELECT query to extract sensitive credit card data from the 'card_payment' table. The attack leverages unsanitized input in the 'code_no' parameter of 'item_show.php'.