EIP-2026-108184

This exploit targets a PHP object injection vulnerability in Joomla 3.0.0 to 3.4.6, allowing remote code execution by manipulating serialized objects in the login process. It implants a backdoor in the configuration.php file via an eval statement, enabling arbitrary command execution.