EIP-2026-105919

This exploit demonstrates an authenticated arbitrary file upload vulnerability in Clinic Management System 1.0, allowing remote code execution via a maliciously crafted PHP file. The PoC includes a multipart/form-data request to upload a PHP shell.