EIP-2026-106672

This PHP script exploits an arbitrary file upload vulnerability in the Hupsi_fancybox Plugin for e107 by sending a crafted POST request via cURL to upload a malicious file ('lo.php'). The vulnerability arises from insufficient input sanitization in the 'uploadify.php' endpoint.