EIP-2026-109502

This exploit leverages an authentication bypass vulnerability in MKPortal by tricking an administrator into executing a malicious SWF file. The SWF file sends a POST request to save permissions, granting administrative access to guests, which can then be used to upload a PHP shell.