EIP-2026-110268

This exploit leverages a vulnerability in OpenCart's json_decode function in /upload/system/helper/json.php, where improper sanitization allows PHP code injection. The exploit demonstrates RCE by injecting malicious payloads into user-controlled fields, which are executed when processed by the vulnerable function.