EIP-2026-105991

This exploit demonstrates an arbitrary file upload vulnerability in CMS Made Simple's Download Manager module (version 1.4.1). It uploads a PHP shell via a malformed multipart/form-data request and verifies its presence by accessing the uploaded file.