Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier when register_globals is disabled allows remote attackers to execute arbitrary PHP code via the _SERVERREMOTE_ADDR parameter which is injected into a .inc script that is later included by the main script.