EIP-2026-110380

This exploit targets osCommerce 2.3.4.1 by injecting a PHP payload into the 'DB_DATABASE' parameter during the installation process, allowing remote command execution without authentication. The payload is executed via the 'configure.php' file, which reads the injected command output.