Authenticated code execution via chunked upload path

Unrestricted file upload in DouPHP 1.8 Release 20251022 allows remote authenticated users to execute PHP code through the admin interface. The bigfile method derives a destination from attacker-controlled module and sql_link_url values, then passes the resulting path to move_uploaded_file without restricting the uploaded type. Administrator access is required, and a successful request writes an executable PHP file beneath the website's images directory.