EIP-2026-108030

The exploit demonstrates a remote file inclusion vulnerability in JAF CMS 4.0.0 RC2 due to improper input sanitization. Attackers can include arbitrary remote files containing malicious PHP code via multiple parameters in forum.php, headlines.php, and main.php.