EIP-2026-109521

This exploit demonstrates a remote SQL injection vulnerability in Moa Gallery 1.2.0 via the 'gallery_id' parameter in index.php. The PoC uses a UNION-based SQLi to extract user credentials (name and password) from the 'moa_users' table.