PHP remote file inclusion vulnerability in preview.php in Reamday Enterprises Magic News Lite 1.2.3 when register_globals is enabled allows remote attackers to include arbitrary files via a URL in the php_script_path parameter.