EIP-2026-111818

This exploit demonstrates a remote code execution (RCE) vulnerability in Rukovoditel 3.3.1 by injecting PHP code into the metadata of a JPEG file, encoding it in base64, and uploading it as a profile photo. The exploit leverages improper handling of file uploads to execute arbitrary PHP code.