Code execution via extension-filter bypass

Unrestricted file upload in zzzCMS 2.1.9 allows remote authenticated users to execute PHP code through a crafted remote image URL. The admin save_upload handler removes the substring php only once from the configurable extension list, so pphphp becomes php; down_url then trusts that list and writes downloaded content under the remote filename. The published proof requires valid administrator session cookies to change the upload settings before invoking catchimage, and successful exploitation runs code with the web application's privileges.