CVE:CVE-2005-0647
CNNVD:CNNVD-200505-429
paNews 2.0.4b中的admin_setup.php允许远程攻击者通过(1)$form[comments]或(2)$form[autoapprove]参数来注入任意PHP代码，并写入到config.php。
solution:Upgrade php_arena panews to a higher version than 2.0.4b,and avoid the version 2.0.4b