P4W

The issue allows an attacker to execute arbitrary commands on the remote server due to a path traversal vulnerability. This occurs when the `homedirs` option is used.

The issue concerns SQL injection in the modules/News/function.admin articlestab.php file. Specifically, the `$sortby` variable is concatenated with `$query1`, allowing for the injection of arbitrary SQL language without using the '.' character.

The issue allows for directory traversal, potentially leading to remote code execution. This can be achieved by uploading a specially crafted txt file into the lib directory due to a `wfu include lib` call.