EIP-2026-112399

This exploit demonstrates an arbitrary file upload vulnerability in Sports Clubs Web Panel 0.0.1, allowing attackers to upload malicious PHP files via the 'Add Ground' function. The exploit leverages a misconfiguration where the 'grounds' directory must be manually created by the admin, enabling unauthenticated file uploads.