EIP-2026-106196

This exploit demonstrates an unauthenticated file upload vulnerability in Covid-19 Contact Tracing System 1.0, leading to remote code execution via a PHP reverse shell. The PoC uploads a malicious PHP file and triggers it by accessing the login page.