EIP-2026-112280

The exploit demonstrates an error-based SQL injection vulnerability in the 'access_login' parameter of the SOA School Management Software. It provides specific payloads using MySQL functions like extractvalue() and updatexml() to trigger XPATH errors, leaking database information such as user and version details.