EIP-2026-111056

This exploit leverages a PHP object injection vulnerability in phpFox <= 4.8.13 via the 'url' parameter in the /core/redirect route. It constructs a malicious serialized object chain to achieve remote code execution by exploiting the __toString magic method.