Remote code execution via PHP string interpolation

Code injection in phome Empirebak 2010 allows remote attackers to execute arbitrary PHP code through the generated config.php file. The configuration writer places attacker-controlled content inside a double-quoted PHP string, where ${...} interpolation evaluates an injected expression when config.php is included. Exploitation requires control of configuration-file content; the disclosure does not identify the input path, and execution is limited to the PHP process context.