EIP-2026-112402

This exploit demonstrates a path traversal vulnerability in SQL Buddy 1.3.3, allowing unauthorized access to sensitive files by appending a '#' character to bypass PHP concatenation checks. The PoC includes specific payloads to read arbitrary files, including those outside the web root.