EIP-2026-111830

This Python script exploits a SQL injection vulnerability in RunCMS <= 1.6.1 by injecting malicious SQL into the 'msg_image' parameter. It extracts user credentials (username and password hash) from the database and sends them via a private message to the attacker's account.