EIP-2026-105972

The exploit demonstrates a PHP code injection vulnerability in CMS Gratis Indonesia 2.2 beta 1 by injecting arbitrary PHP code via the `db_prefix` parameter during setup. The crafted POST request includes a payload that executes `phpinfo()`, proving remote code execution (RCE) is achievable.