Unauthenticated code execution via config file injection

Code injection in phomebak.php in SeaCMS 13.3 allows remote attackers to execute arbitrary PHP code via a crafted request. Ebak_DoEbak writes the POST tablename value into an attacker-chosen config.php file without filtering or validation, then PHP parses the injected content when that file is requested. No authentication or user interaction is required, so network exposure of the ebak endpoint permits arbitrary command execution with the application's privileges.