Global variable overwrite vulnerability in PHP-Nuke allows remote attackers to conduct remote PHP file inclusion attacks via a modified phpbbrootpath parameter to the admin scripts (1) index.php, (2) adminugauth.php, (3) adminboard.php, (4) admindisallow.php, (5) adminforumauth.php, (6) admingroups.php, (7) adminranks.php, (8) adminstyles.php, (9) adminuserban.php, (10) adminwords.php, (11) adminavatar.php, (12) admindbutilities.php, (13) adminforumprune.php, (14) adminforums.php, (15) adminmassemail.php, (16) adminsmilies.php, (17) adminugauth.php, and (18) adminusers.php, which overwrites $phpbbrootpath when the importrequestvariables function is executed after $phpbbrootpath has been initialized to a static value.