EIP-2026-109001

The exploit demonstrates a Local File Inclusion (LFI) vulnerability in 'private.php' and a Remote Code Execution (RCE) vulnerability in 'rooms/get.php' by injecting PHP code into the 'name' and 'ROOM' parameters. The PoC includes example URLs to exploit these vulnerabilities.