EIP-2026-111113

This PoC exploits a PHP code injection vulnerability in PHPList by leveraging the `call_user_func_array` function to execute arbitrary PHP code via the `rs` POST parameter. The vulnerability arises from insufficient validation of user-supplied input in the Sajax.php file.