EIP-2026-107777

This exploit leverages a file write vulnerability in Ignition 1.3's i-options.php to inject arbitrary PHP code into the settings.php file via the 'lang' POST parameter. The injected code allows remote command execution via a GET parameter 'cmd'.