EIP-2026-111352

This exploit targets Pluck CMS 4.5.3 by leveraging a file corruption vulnerability in update.php and a subsequent file inclusion flaw due to improper handling of GLOBALS when register_globals is enabled. It achieves remote code execution by injecting a PHP shell into data/count.php.