An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_save.
The product does not adequately filter user-controlled input for special elements with control implications.