EIP-2026-111221

This exploit leverages a PHP application's use of register_globals to bypass authentication and upload a malicious avatar file, enabling remote code execution or file upload. It manipulates the application's configuration to include the malicious file via a null byte injection.