Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote authenticated users to inject arbitrary PHP code via the xtop parameter in a \ConfigSave\ op to admin.php which can later be accessed via a \Configure\ op to admin.php.