finecms in 1.9.5\controllers\member\ContentController.php allows remote malicious users to operate website database
finecms project finecms 1.9.5