EIP-2026-109901

The exploit demonstrates SQL injection and XSS vulnerabilities in New STAR 2.1 via crafted GET parameters. The SQLi payload uses time-based blind injection, while the XSS payload leverages improper input sanitization in the search functionality.