PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with registerglobals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[srcdir] parameter.

Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the srcdir parameter to (a) billingprocess.php, (b) billingreport.php, (c) billingreportxml.php, and (d) printbillingreport.php in interface/billing/; (e) login.php; (f) interface/batchcom/batchcom.php; (g) interface/login/login.php; (h) maininfo.php and (i) main.php in interface/main/; (j) interface/new/newpatientsave.php; (k) interface/practice/inssearch.php; (l) interface/logout.php; (m) customreportrange.php, (n) playersreport.php, and (o) frontreceiptsreport.php in interface/reports/; (p) facilityadmin.php, (q) usergroupadmin.php, and (r) userinfo.php in interface/usergroup/; or (s) custom/importxml.php.

PHP remote file inclusion vulnerability in contrib/forms/evaluation/CFormEvaluation.class.php in OpenEMR 2.8.1 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[fileroot] parameter.