EIP-2026-111939

This PHP script demonstrates an unauthenticated remote code execution (RCE) vulnerability in Schoolhos CMS 2.29 by uploading a malicious PHP file via an insecure file upload mechanism. It also includes a proof-of-concept for an unauthenticated SQL injection flaw.