EIP-2026-110294

This exploit targets OpenEMR < 5.0.1 (Patch 4) by authenticating as an admin, uploading a PHP reverse shell payload via the import_template.php endpoint, and executing it to achieve remote code execution. The payload establishes a reverse shell connection to a specified IP and port.