phpFileManager version 0.9.8 suffers from a cross site request forgery vulnerability that can result in a backdoor shell being uploaded.