EIP-2026-110263

The exploit demonstrates a Local File Inclusion (LFI) vulnerability in OpenCart 1.4.9 by manipulating the 'route' and 'product_id' parameters with null byte termination to read arbitrary files. The provided URLs show paths to sensitive files like /etc/passwd.