AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direct request to (1) user.php (2) articles.php (3) articlesuspend.php (4) site.php (5) statistics.php (6) mail.php (7) category.php (8) subcategory.php (9) changepassword.php (10) polling.php and (11) logo.php in admin/.