EIP-2026-107317

This exploit leverages a combination of XSS (CVE-2019-11408) and command injection (CVE-2019-11409) in FusionPBX <= 4.4.3 to achieve remote code execution. It sends a maliciously crafted SIP INVITE packet with an XSS payload in the 'From' field, which triggers a reverse shell via the exec.php script.