EIP-2026-111661

The exploit demonstrates a remote file inclusion vulnerability in Ractive Popper by injecting a malicious URL into the 'form' parameter of childwindow.inc.php. This allows an attacker to execute arbitrary commands (e.g., 'id') by including a remote shell script.