EIP-2026-110970

This PHP script exploits a SQL injection vulnerability in phpBB 3's memberlist.php via the 'ip' argument to disclose admin credentials. It requires a global moderator account and uses blind SQL injection to extract the admin's username and password hash.