phpPowerCards db/txt.inc.php does not initialize the $file variable before using it in the fopen() function on line 10, after $file is opened it then writes several variables which are also uninitialized to $file using the fputs() function. Assuming register_globals = on, we can initialize these variables in a query string and then write anything to a file we desire on the target box that's running phpPowerCards.