EIP-2026-107547

PRE-CVE

H2O-CMS 3.4 - PHP Code Injection / Cookie Authentication Bypass

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-107547. PoCs published by StAkeR.

AI-analyzed exploit summary This Perl script exploits a PHP code injection vulnerability in H2O-CMS <= 3.4 by injecting malicious PHP code into configuration parameters, leading to remote command execution. It also bypasses authentication via cookie manipulation.

Description

H2O-CMS 3.4 - PHP Code Injection / Cookie Authentication Bypass

Exploits (1)

exploitdb WORKING POC VERIFIED

by StAkeR · perlwebappsphp

https://www.exploit-db.com/exploits/32540

View Code ZIP pw:eip

This Perl script exploits a PHP code injection vulnerability in H2O-CMS <= 3.4 by injecting malicious PHP code into configuration parameters, leading to remote command execution. It also bypasses authentication via cookie manipulation.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: H2O-CMS <= 3.4

No auth needed

Prerequisites: Target running H2O-CMS <= 3.4 · Network access to the target

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026