EIP-2026-111631

This exploit demonstrates a Remote File Include (RFI) vulnerability in QuestCMS, allowing an attacker to include and execute arbitrary remote files via the 'pi' parameter in main.php. The PoC shows a simple command injection example using the 'cmd' parameter.