Direct static code injection vulnerability in acp/savenews.php in Sciurus Hosting Panel possibly 2.0.3 allows remote attackers to inject arbitrary PHP code via the filecontents parameter which can be executed by accessing includes/news.php.