prevented remote code execution according to a report filed on the old github repository.

webroot/ajax.php

@@ -7,7 +7,7 @@
 
   if(isset($_GET["say"]))
   {
-    exec('echo "'.$_GET["say"].'" > tmp/say');
+    exec('echo "'.escapeshellarg($_GET["say"]).'" > tmp/say');
   }
 
 ?>