PHP remote file inclusion vulnerability in University of British Columbia iPeer 2.0 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: it is possible that this issue is related to CakePHP.