EIP-2026-113467

This Ruby script exploits a SQL injection vulnerability in Woltlab Burning Board Userlocator V2.5 by injecting crafted SQL queries into the 'x' parameter of 'locator.php'. It extracts user credentials (userid, username, password, and email) from the 'bb1_users' table by leveraging a UNION-based SQL injection technique.