Multiple PHP remote file inclusion vulnerabilities in openMairie openCimetiere 2.01, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathom parameter to (1) autorisation.class.php, (2) courrierautorisation.class.php, (3) droit.class.php, (4) profil.class.php, (5) tempdefuntsansemplacement.class.php, (6) utils.class.php, (7) cimetiere.class.php, (8) defunt.class.php, (9) emplacement.class.php, (10) tabemplacement.class.php, (11) tempemplacement.class.php, (12) voie.class.php, (13) collectivite.class.php, (14) defunttransfert.class.php, (15) entreprise.class.php, (16) tempautorisation.class.php, (17) travaux.class.php, (18) zone.class.php, (19) courrier.class.php, (20) dossier.class.php, (21) plans.class.php, (22) tempdefunt.class.php, and (23) utilisateur.class.php in obj/.