phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22201
Reference (s):
- https://github.com/blindkey/cve_like/issues/4