EIP-2026-110498

PRE-CVE

PaulShop - SQL Injection / Cross-Site Scripting

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-110498. PoCs published by BTIS Team.

AI-analyzed exploit summary This exploit demonstrates SQL injection via the 'q' parameter in the search page and stored XSS in the member's profile page. It includes payloads and curl commands to trigger the vulnerabilities.

Description

PaulShop - SQL Injection / Cross-Site Scripting

Exploits (1)

exploitdb WORKING POC

by BTIS Team · textwebappsphp

https://www.exploit-db.com/exploits/42359

View Code ZIP pw:eip

This exploit demonstrates SQL injection via the 'q' parameter in the search page and stored XSS in the member's profile page. It includes payloads and curl commands to trigger the vulnerabilities.

Classification

Working Poc 90%

Attack Type

Sqli | Xss

Complexity

Trivial

Reliability

Reliable

Target: PaulShop CMS (version as of 03/27/2017)

Auth required

Prerequisites: Access to the search page · Valid session cookies for XSS exploitation

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026