EIP-2026-110587

This is a technical writeup describing a remote file inclusion vulnerability in PHlyMail Lite <= 3.4.4 due to unsanitized $_PM_[path][handler] variable when register_globals is enabled. The exploit involves injecting a malicious script via the handler parameter.