EIP-2026-110424

This exploit demonstrates a Remote File Include (RFI) vulnerability in Ovidentia Module online 2.8 due to an uninitialized $GLOBALS['babAddonPhpPath'] variable. An attacker can inject arbitrary PHP code via the GLOBALS[babAddonPhpPath] parameter in the admin.php script.