EIP-2026-108185

This exploit leverages PHP object injection in Joomla! versions 3.0.0 to 3.4.6 to achieve unauthenticated remote code execution by backdooring the configuration.php file. It uses a crafted payload to append an eval statement, allowing arbitrary command execution via POST requests.