EIP-2026-106976

This exploit demonstrates an authentication bypass via SQL injection in ExtCalendar2 by manipulating cookie values, followed by uploading a PHP backdoor through file upload functionality. It achieves remote command execution by leveraging misconfigured file extension settings.