Acumatica ERP: Authenticated RCE via Customization Publish Chain Webshell

Acumatica ERP's Customization publish framework writes manifest-declared files to the IIS webroot with no path or extension validation. Admin holds the Customizer role by default, so a crafted package publishes an .aspx webshell for authenticated RCE as the IIS AppPool identity.