EIP-2026-110346

This exploit demonstrates an SQL injection vulnerability in Orooj CMS by injecting a UNION-based query to extract usernames and passwords from the `tbl_site_member` table. The attack leverages insufficient input sanitization in the `nid` parameter of `news.php`.