EIP-2026-107819

This exploit demonstrates an arbitrary file upload vulnerability in In-Portal v4.3.1, allowing authenticated users to upload a PHP shell via the profile image upload functionality. The shell is then accessible at a predictable path, leading to remote code execution.