{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "HTTP GET /restart?id=<PM2 id>;<injected shell command>",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "node",
    "express",
    "express-session",
    "pm2",
    "child_process.exec"
  ],
  "target_identity": {
    "repository_url": "https://github.com/4xmen/pm2panel.git",
    "commit_sha": "dd2a7d2e8cb4dacefb618ab54b0a8f7dc6742fa0",
    "target_digest": "bba0b98c59f5021177796d4c7a0bb3a76337d8b4d6b18f99de44551ea24bdce5",
    "runtime_digest": null,
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "logs/artifacts/http/response_login.txt",
    "logs/artifacts/http/request_exploit.txt",
    "logs/artifacts/http/response_exploit.txt",
    "logs/artifacts/http/marker_evidence.txt",
    "logs/artifacts/http/response_unauth.txt",
    "logs/artifacts/http/safe_restart_status.txt",
    "logs/artifacts/http/pm2panel_service_final.log"
  ],
  "notes": "Command injection via /restart endpoint confirmed. Marker file created by injected touch command. Unauthenticated requests rejected (302). Safe requests without injection do not create marker."
}