PHP remote file inclusion vulnerability in common/db.php in samPHPweb possibly 4.2.2 and others as provided with SAM Broadcaster allows remote attackers to execute arbitrary PHP code via a URL in the commonpath parameter.