EIP-2026-110412

This exploit demonstrates an authenticated arbitrary code execution vulnerability in OV3 Online Administration 3.0. It bypasses file extension checks by uploading a malicious PHP script with a .jpg extension, which is then stored and executed in the '/media/customers/' directory.