EIP-2026-108752

The exploit demonstrates two vulnerabilities in the Joomsport component for Joomla: an arbitrary file upload vulnerability (leading to RCE) and a blind SQL injection vulnerability. The file upload exploit bypasses restrictions by disguising a PHP shell as a PNG file, while the SQL injection exploit sends a crafted query to extract data from the database.