EIP-2026-105924

This exploit demonstrates a two-phase attack against Clinic Queuing System 1.0, first creating an admin user (CVE-2024-0264) and then leveraging an LFI with PHP filter chaining for RCE (CVE-2024-0265). The payload executes arbitrary commands and uploads a backdoor.