Update README.md

2026-07-18 19:05:08 +00:00 · 2026-07-18 02:16:04 +02:00
parent f157decdb8
commit caab2a98d1
1 changed files with 4 additions and 0 deletions
@@ -48,6 +48,10 @@ can use that database read path to recover administrator password hashes. Turnin
 plugin-upload code execution is outside the unauthenticated primitive and depends on obtaining valid
 administrator credentials.

+Searchlight has not published the final jump from SQLi to pre-auth RCE. That may involve a
+database file-write trick such as MySQL `OUTFILE`, or it may be something else in core. This repo
+does not include that step.
+
 ## Requirements

 Python 3.8+ and the standard library. No third-party dependencies.