PHP remote file inclusion vulnerability in impex/ImpExData.php in vBulletin ImpEx module 1.74 when register_globals is disabled allows remote attackers to include arbitrary files via the systempath parameter.