mcms v5.2.8 backstage RCE

[penson233]

The template management office on the background system Settings module can modify the Freemarker render template, which can result in freemarker template injection

Insert Payload into a render page to save it

Find the place to render the template

Control the server by executing commands

[killfen]

5.2.9 fix it