PHP remote file inclusion vulnerability in CaLogic 1.2.2 allows remote attackers to execute arbitrary code via the CLPATH parameter to (1) cl_minical.php (2) clmcpreload.php (3) mcconfig.php or (4) mcpi-demo.php.