EIP-2026-111212

This exploit leverages a PHP code injection vulnerability in PhpStats <= 0.1.9.1b by injecting malicious PHP code into the 'report_w_day' parameter, which is then executed via the admin interface. The exploit sends a crafted POST request to inject the payload and a subsequent GET request to trigger command execution.