EIP-2026-114509

This PHP script exploits a file upload vulnerability in YaPIG 0.95b by crafting a malicious multipart/form-data POST request to 'add_comment.php', allowing arbitrary file upload and remote code execution via a PHP shell.