Onkel_Fisch

The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities in the modules.php file when magic quotes gpc is disabled. This is achieved by exploiting the `name`, `sid`, and `pid` parameters in a POST request, which bypasses the security checks performed for GET requests.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the `wn userpw` parameter to "startup.php", `cat`, `id`, or `stof` parameters to "news.php", or the `id` parameter to "print.php".

The issue allows remote attackers to obtain sensitive information via a direct request to files in the actions directory. This is possible because the error messages from these files reveal the path. For example, this can be demonstrated by accessing the "cat.add.php" file.