EIP-2026-113409

This is a proof-of-concept for a blind SQL injection vulnerability in WHMCS. It demonstrates how an attacker can inject malicious SQL queries via the 'google-order-number' parameter in a POST request to the Google Checkout callback endpoint.