EIP-2026-104876
PRE-CVEA2billing 2.x - Backup File Download / Remote Code Execution
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-104876. PoCs published by 0x4148.
AI-analyzed exploit summary This exploit chains an unauthenticated backup dump vulnerability with an SQL injection to achieve remote code execution (RCE) in A2billing 2.x. The attacker injects malicious PHP code into the database via SQLi, then triggers a backup to a .php file, allowing arbitrary command execution.
Description
A2billing 2.x - Backup File Download / Remote Code Execution
Exploits (1)
This exploit chains an unauthenticated backup dump vulnerability with an SQL injection to achieve remote code execution (RCE) in A2billing 2.x. The attacker injects malicious PHP code into the database via SQLi, then triggers a backup to a .php file, allowing arbitrary command execution.