Administrator code execution via backup file editing

Code execution in CMSimple 5.16 allows remote authenticated users with administrator rights to execute arbitrary PHP through backup editing. The backup interface accepts action=edit instead of action=download, opens content/content.php in its code editor, and saves attacker-supplied PHP. Administrator authentication is required; the saved payload becomes directly web-accessible and runs commands in the web-server context.