Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier with register_globals and allow_url_fopen enabled allow remote attackers to execute arbitrary code via the bbPathpath parameter in (1) class.forumposts.php and (2) forumpollrenderer.php.