Espcms background getshell-3, and can use csrf interaction to force Administrator getshell

The template modified in the background is not filtered out. you can insert php code in the template (for demonstration purposes, phpinfo is used). Originally, the harm of getshell in the background should be low because administrator permissions are required. However, the espcms background operation does not have a token. Through the interaction of csrf, the administrator can be forced to do many things. The package for modifying the template to shell is as follows: there is no token, so you can click an automatic submission form to the Administrator, and then the system will automatically getshell. (Here we mainly use getshell in the background. csrf will not talk about it anymore. For more information about POC, see some of my previous vulnerabilities)

 Solution:

1. Disable PHP Execution in the template, or only allow the execution of harmless PHP functions. 2. The background operation must have a token.