EIP-2026-110593

PRE-CVE

PhoenixCMS 1.7 - Local File Inclusion / SQL Injection

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-110593. PoCs published by KedAns-Dz.

AI-analyzed exploit summary The exploit demonstrates a local file inclusion (LFI) vulnerability and an SQL injection (SQLi) vulnerability in PhoenixCMS 1.7.0. The LFI allows directory traversal to access arbitrary files, while the SQLi enables database manipulation through crafted input.

Description

PhoenixCMS 1.7 - Local File Inclusion / SQL Injection

Exploits (1)

exploitdb WORKING POC VERIFIED

by KedAns-Dz · textwebappsphp

https://www.exploit-db.com/exploits/35619

View Code ZIP pw:eip

The exploit demonstrates a local file inclusion (LFI) vulnerability and an SQL injection (SQLi) vulnerability in PhoenixCMS 1.7.0. The LFI allows directory traversal to access arbitrary files, while the SQLi enables database manipulation through crafted input.

Classification

Working Poc 90%

Attack Type

Sqli | Info Leak

Complexity

Trivial

Reliability

Reliable

Target: PhoenixCMS 1.7.0

No auth needed

Prerequisites: Access to the target web application

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026