Ant!-Tr0J4N

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `view` parameter in the "index.php" file.

A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack administrator authentication for creating new users via the options action in the news/admin.php file.

The issue allows remote attackers to execute arbitrary SQL commands via the `news` parameter in index.php.

The issue allows remote attackers to obtain the source code of executable files within the web document root. This is achieved by exploiting the download parameter in the index.php file.