EIP-2026-110165

This exploit demonstrates an unauthenticated remote code execution (RCE) vulnerability in Online Railway Reservation System 1.0. It leverages a file upload mechanism in the `SystemSettings.php` endpoint to inject PHP code, which is then executed when the homepage is accessed.