Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10 when register_globals is enabled allow remote attackers to create or overwrite arbitrary files via the (1) emailto (2) emailfrom (3) nameto (4) namefrom (5) picture (6) comment or (7) sessionID parameter as demonstrated by creating a new .php file that permits remote file inclusion and then requesting this file.