EIP-2026-114572

This exploit demonstrates an arbitrary file upload vulnerability in ZaoCMS (PhpCommander) by providing a direct URL to upload a shell and its subsequent location. The PoC is straightforward and functional, requiring no additional steps beyond accessing the specified endpoint.