EIP-2026-110281

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in OpenDb 1.5.0.4 due to improper input validation in the `_OPENDB_THEME` and `site_plugin_classname` parameters. The vulnerability allows an attacker to include arbitrary local files by appending a null byte (`%00`) to bypass file extension checks.