Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-109799. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary The exploit demonstrates a SQL injection vulnerability in MySQL Blob Uploader v1.0, allowing an attacker to extract sensitive data (e.g., admin credentials) via crafted input in the 'id' parameter of download.php. The payload uses UNION-based injection with concat_ws to exfiltrate data from the 'admin' table.
Description
MySQL File Uploader 1.0 - 'id' SQL Injection
Exploits (1)
The exploit demonstrates a SQL injection vulnerability in MySQL Blob Uploader v1.0, allowing an attacker to extract sensitive data (e.g., admin credentials) via crafted input in the 'id' parameter of download.php. The payload uses UNION-based injection with concat_ws to exfiltrate data from the 'admin' table.