EIP-2026-105334

This PHP script exploits a Local File Inclusion (LFI) vulnerability in Awcm CMS 2.x by manipulating the 'awcm_lang' cookie to include arbitrary files. It sends a crafted HTTP request to 'notify.php' and retrieves the contents of the specified file (e.g., '/etc/passwd').