EIP-2026-109571

This exploit targets Monstra CMS 3.0.4 by authenticating as an admin, bypassing CSRF protection, and uploading a malicious chunk file to achieve remote code execution. The payload is a simple PHP web shell that executes system commands via GET parameter.