EIP-2026-111112

This exploit targets PHPList <= 2.10.2 by leveraging the register_globals=On setting to inject arbitrary code into log files and execute commands via file inclusion. It demonstrates a remote command execution vulnerability by manipulating GLOBALS[] variables to include malicious log entries.