EIP-2026-111548

The exploit demonstrates SQL injection vulnerabilities in PromoProducts by injecting malicious SQL queries via the 'product_id' and 'sub_cat' parameters. It extracts user credentials (username and password) from the 'user' table using UNION-based SQLi techniques.