Directory traversal vulnerability in mods/Integrated/index.php in SineCMS 2.3.5 and earlier when register_globals is enabled allows remote attackers to include and execute arbitrary local files via the sineconfigindex_main parameter.