EIP-2026-106564

This exploit demonstrates a CSRF vulnerability in Dream CMS 2.3.0 that allows an attacker to add a PHP extension to the allowed list and upload a malicious PHP file, leading to remote code execution. The PoC uses hidden forms and JavaScript to automate the attack steps.