EIP-2026-112224

This PHP script exploits a remote PHP code injection vulnerability in Small-Cms by sending a crafted HTTP request to install.php with malicious input in the hostname parameter, allowing arbitrary command execution via system($_GET['cmd']).