Directory traversal vulnerability in index.php in justVisual CMS 2.0 when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files directory traversal sequences in the p parameter. NOTE: some of these details are obtained from third party information.