Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php.Referenceshttps://github.com/hyyyp/HYBBS2/issues/34