Multiple PHP remote file inclusion vulnerabilities in Michael Dempfle Joomla Flash Uploader (comjfu or comjoomlaflashuploader) 2.5.1 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to (1) install.joomlaflashuploader.php and (2) uninstall.joomlaflashuploader.php.