Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02 when register_globals is enabled allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) autorisation_normale.class.php (2) collectivite.class.php (3) dossier.class.php (4) norme_simplifiee.class.php (5) registre.class.php (6) autorisation_unique.class.php (7) demande_avis.class.php (8) droit.class.php (9) organisme.class.php (10) service.class.php (11) categorie_donnee.class.php (12) destinataire.class.php (13) profil.class.php (14) tabdyn_visu.class.php (15) categorie_personne.class.php (16) dispense.class.php (17) modificatif.class.php (18) reference.class.php and (19) utilisateur.class.php in obj/.