EIP-2026-112220

This exploit demonstrates a time-based SQL injection vulnerability in Small CRM 2.0 via the 'email' parameter in the forgot-password.php endpoint. The payload uses a SLEEP function to confirm the vulnerability, exploiting unsanitized user input in the SQL query.