Agix

The issue is related to a flaw in the simpleupload.py script in the Web UI, which allows a remote attacker to inject arbitrary commands by manipulating the `tns appliance session user` parameter. This can enable the attacker to execute commands remotely.

The issue allows remote attackers to conduct PHP object injection attacks, enabling them to execute arbitrary PHP code. This is achieved by sending crafted serialized shopping cart data.