EIP-2026-106243

This exploit demonstrates an unrestricted file upload vulnerability in Croogo 3.0.2, allowing an authenticated attacker to upload a malicious PHP script via the 'Themes' settings section. The script executes arbitrary commands (e.g., 'netstat -an') when accessed.