OctoberCMS

EXPLOIT: https://www.exploit-db.com/exploits/41936

Possible Login Page: http://10.10.10.16/backend/backend/auth/signin

Default Credentials: admin:admin

File Upload at: Media -> Upload

Shell: Change file extension to .php5 as it is allowed according to the exploit code.