EIP-2026-106526

This exploit demonstrates an unauthenticated remote code execution vulnerability in Dolibarr ERP CRM versions <=7.0.3. The vulnerability is exploited via a POST request to the installation step1.php script, where the 'db_name' parameter is manipulated to inject PHP code that executes system commands.