Authenticated code execution via configuration Lua injection

Code injection in Creacast Creabox Manager 4.4.4 allows remote authenticated users to execute arbitrary commands through edit.php. The endpoint accepts attacker-supplied Lua in configuration data and later executes that configuration on the server without neutralizing the code. Access to the management workflow is required; successful exploitation supports reverse-shell execution and full server compromise.