EIP-2026-110354

The exploit demonstrates a remote file upload and file disclosure vulnerability in osCommerce. It provides a form to upload arbitrary files and another to create files with arbitrary content, leveraging insufficient input sanitization. The file disclosure URL allows reading sensitive files like configuration files.