Xy7

The issue allows remote attackers to execute arbitrary SQL commands via the `id` parameter in the announcements.php file.

The issue allows remote attackers to obtain system information. This is achieved by setting the `action` parameter to `php info` in the "misc.php" endpoint.

The issue allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the `forward` parameter in a logout action in the `api.php` file.

A directory traversal issue exists, allowing remote attackers to read arbitrary files by utilizing a .. (dot dot) in the `neturl` parameter of the collect.php file.