EIP-2026-109239

This exploit leverages a PHP object injection vulnerability in Magento CE < 1.9.0.1 via a crafted serialized payload. It chains Zend framework classes to achieve remote code execution by abusing the `call_user_func` mechanism.