Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-110767. PoCs published by brain[pillow].
AI-analyzed exploit summary The exploit leverages an eval injection vulnerability in PHP Support Tickets v2.2, where the `getPageName()` function dynamically evaluates a user-controlled variable (`page`) without proper sanitization. By injecting arbitrary PHP code via the `page` parameter, an attacker can achieve remote code execution (RCE).
Description
PHP Support Tickets 2.2 - Code Execution
Exploits (1)
The exploit leverages an eval injection vulnerability in PHP Support Tickets v2.2, where the `getPageName()` function dynamically evaluates a user-controlled variable (`page`) without proper sanitization. By injecting arbitrary PHP code via the `page` parameter, an attacker can achieve remote code execution (RCE).