The vulnerability exists due to insufficient access restrictions to the installation script "/install/install.php", which is present by default after application installation. A remote attacker can change applicationâ??s configuration, such as database host, forcing the application to connect to an external database and spoof information on the website, obtain access to sensitive information or simply cause a denial of service. The vulnerability exists due to insufficient validation of user-supplied input passed to the "db_host", "db_user", "db_pass", a "db_prefix" parameters in the "/install/install.php" script. A remote attacker can inject and execute arbitrary PHP code with privileges of web server.