EIP-2026-114415

This PHP script exploits a SQL injection vulnerability in xBtiTracker by injecting a malicious cookie to extract user credentials (id, username, password, email) from the database. It uses a time-based blind SQLi technique with a crafted CONCAT_WS payload to leak data.