EIP-2026-110387

This exploit demonstrates an SQL injection vulnerability in osCommerce Visitor Web Stats by manipulating the 'Accept-Language' header to extract administrator credentials via blind SQLi techniques. It systematically brute-forces usernames and passwords using binary search on character sets.