ukcms v1.1.7 (and other Lower version ) has a FileUpload vulnerability

[Porlockzzz]

Vulnerability description
The CMS background content management editor has a file uploading vulnerability. By modifying the background file upload parameter: the "Allow upload file suffix" section, you can bypass the restrictions on php file upload by cms, and then pass the Trojan horse and the getshell
poc
1.Login to the backstage as the admin;

2.add the value 'php' into 'upload_file_ext' which is a cms parameter use to limit upload suffix.(Note: use two 'php' to bypass limit eg: php,php)
url: admin.php/admin/configset/index/group/upload.html

3.Go to any page editing section,choose the upload function.
First,Modify the suffix of a PHP Trojan to .txt(Note: For pass the limit)
Second,click the button to save the upload file
Next,Use BURPSUITE for packet capture and modification,modify the suffix to .php,add some arbitrarily string before the file content(Note:For pass the file head check),and then upload it!

4.The last step,connection the trojan

Success!