Authenticated PHP code execution via unsafe cache write

Code injection in WuzhiCMS 4.1 allows remote authenticated users with administrator access to execute PHP code through the setting parameter. The attachment setting handler's set_cache function writes the setting value directly into a server-side file without adequate validation or filtering. Administrator privileges and two requests are required; exploitation can create or overwrite a PHP file and execute attacker-supplied code.