EIP-2026-107191

This exploit demonstrates a PHP Object Injection vulnerability in Forma LMS 1.3, leveraging unsafe unserialize() usage in the writemessage() function to trigger a SQL injection. The PoC includes a crafted serialized payload and HTTP request to exploit the flaw.