Letmejustdoit

The issue allows remote attackers to read arbitrary files by sending a crafted request to the `admin.php?s=Tpl/Add/id` endpoint. For example, an attacker can read the global configuration file by accessing `admin.php?s=Tpl/Add/id/.PublicConfigconfig.ini.php`.

The issue allows SQL injection via the `keywords` parameter in the "index.php?m=promote&f=index&v=search" endpoint.