Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-112700. PoCs published by Kacper Szurek.
AI-analyzed exploit summary This exploit demonstrates a blind SQL injection vulnerability in Tiny Tiny RSS, where the `item_id` parameter in `process_category_order()` is not properly escaped. The PoC uses a crafted payload to extract the first character of the admin's password hash via time-based SQL injection.
Description
Tiny Tiny RSS - Blind SQL Injection
Exploits (1)
This exploit demonstrates a blind SQL injection vulnerability in Tiny Tiny RSS, where the `item_id` parameter in `process_category_order()` is not properly escaped. The PoC uses a crafted payload to extract the first character of the admin's password hash via time-based SQL injection.