The file manager allows admin users to upload files to the application, the
upload function prevent any php extension from getting uploaded. however the .
phar extension is not restricted (.phar is a php extension), therefore an
authenticated attacker is able to upload a malicious file within this
extenstion(exemple: shell.phar) and gaining a remote code execution on the
server.


1)login with admin 
2) go to site Admin> File manager> upload
3) upload shell.phar which contains <?php system('whoami'); ?>
4) go to the uploads/ directory and execute the malicious file.