Hemantra J Bhati

An issue exists in the Admin Login component within the '/admin/login.php' endpoint. Remote manipulation of the `Username` argument allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution.

A server-side request forgery condition exists in the URL Handler component’s `file get contents()` function. This allows for remote initiation of attacks. The exploit has been publicly disclosed.