mainfile.php in XOOPS 2.0.13.2 and earlier when register_globals is enabled allows remote attackers to overwrite variables such as $xoopsOption'nocommon' and conduct directory traversal attacks or include PHP files via (1) xoopsConfiglanguage to misc.php or (2) xoopsConfigtheme_set to index.php as demonstrated by injecting PHP sequences into a log file.