EIP-2026-109204

The exploit describes an arbitrary file upload vulnerability in Login-Reg Members Management PHP 1.0, where the application fails to validate file types during profile picture uploads, allowing attackers to upload malicious files. The proof of concept outlines the vulnerable code path and demonstrates how an attacker can exploit this to achieve remote code execution.