The vulnerability stems from incomplete input validation in the website builder module. The advisory explicitly states that while dangerous functions like system/exec/shell_exec were blocked, PHP's backtick operator (which triggers shell command execution via the shell_exec() mechanism) was not sanitized. This allows attackers to inject code like uname -a via the PAGE_CONTENT parameter, which gets executed when the generated PHP page is rendered. The vulnerable code path resides in the website module's content processing logic, likely in the controller handling the 'updatesource' action.