CVE-2006-1994: Undefined Security Weakness

PHP remote file inclusion vulnerability in dForum 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DFORUMPATH parameter to 1 about.php, 2 admin.php, 3 anmelden.php, 4 losethread.php, 5 config.php, 6 delpost.php, 7 delthread.php, 8 dfcode.php, 9 download.php, ...