EIP-2026-105925

This exploit demonstrates an unauthenticated remote code execution (RCE) vulnerability in Clinic's Patient Management System 1.0. The attacker uploads a malicious PHP file disguised as a profile picture, bypassing authentication and achieving arbitrary command execution via a simple PHP backdoor.