EIP-2026-109853

The exploit demonstrates two vulnerabilities in Nensor CMS 2.01: a Local File Inclusion (LFI) via the 'sPage' parameter and an authentication bypass using SQL injection. The LFI allows arbitrary file inclusion by appending a null byte, while the SQL injection bypasses authentication with a simple ' or '1=1' payload.