EIP-2026-110269

This exploit demonstrates a blind SQL injection vulnerability in the TMD Vendor System for OpenCart 3.x, allowing an attacker to extract user credentials and reset passwords via time-based inference. The PoC automates the extraction of usernames, emails, and password reset codes.