EIP-2026-106509

This exploit targets a PHP code injection vulnerability in Dokeos LMS <= 1.8.5 via the 'whoisonline.php' script. It leverages unsanitized input passed to 'create_function()' to execute arbitrary PHP code, resulting in a reverse shell.