36Huo

The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by placing the code in the `DB PREFIX` field, which is then written to database.php, when the index.php?s=index/install/setup2 endpoint is accessed and the install.lock file is not present.

The issue allows for arbitrary file deletion. This can be achieved by exploiting the `statics/ueditor/php/controller.php` "action=remove" key parameter, where an attacker can use directory traversal to delete sensitive files, such as the `install.lock` file.