Code injection

Frog CMS 0.9.5 allows PHP code execution via ?php to the admin/?/layout/edit/1 URI...