EIP-2026-110378

This exploit leverages an object injection vulnerability in osCommerce 2.3.4.1 to achieve authenticated arbitrary file upload, allowing an attacker to upload a malicious file (e.g., a web shell) via the newsletter functionality.