EIP-2026-111826

The exploit demonstrates SQL injection vulnerabilities in RunCMS by injecting malicious SQL queries via URL parameters. It targets multiple endpoints in the 'newbb_plus' and 'messages' modules to extract user credentials (e.g., 'pass', 'uname') from the 'runcms_users' table.