one can insert malicious code in the installation process to get a web shell

[PassingFoam]

In the CMS installation process, the configuration file filtering is not rigorous, you can insert malicious code in the installation process to execute arbitrary commands, and even get Webshell

in the install/install.php

author just check the database's name and its passwd,but not check the $dbprefix,so we can get Webshell.

and then