Limbo CMS 1.0.4.2 and earlier with register_globals off does not protect the $_SERVER variable from external modification which allows remote attackers to use the _SERVERREMOTE_ADDR parameter to (1) conduct cross-site scripting (XSS) attacks in the stats module or (2) execute arbitrary code via an eval injection attack in the wrapper option in index2.php.