EIP-2026-114515

This exploit demonstrates a SQL injection vulnerability in YDC's klist.php script, allowing an attacker to extract user credentials from the iadmin table via a crafted UNION-based SQL query.