PHP remote file inclusion vulnerability in openi-admin/base/fileloader.php in OPENi-CMS 1.0.1 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the configopeni_dir parameter.