Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier and possibly 3.2.6 when register_globals is enabled allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) GLOBALSSKIN parameter to index.php and the (2) skin parameter to admin/admin.php.