EIP-2026-109306

This exploit leverages a remote file inclusion vulnerability in Mambo Open Source by injecting a malicious PHP script that creates a superadministrator user in the database. The attacker supplies a controlled 'mosConfig_absolute_path' to execute arbitrary code.