Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0 when register_globals is enabled allows remote attackers to inject arbitrary web script HTML or PHP via the contents parameter whose value is prepended to the file specified by the forum parameter.