EIP-2026-101397

This exploit demonstrates an unauthenticated blind command injection vulnerability in the Osprey Pump Controller 1.0.1 via the 'userName' POST parameter in index.php. The provided curl command injects a sleep command to verify the vulnerability.