http://www.root-security.org/danger/boastMachine.txt Was this tried on a running site?or was this just source inspected? in boastmachine folder, the below shouldn't be vulnerable with config.php declaring $bmc_dir. vote.php -------------------------------------- include_once dirname(__FILE__)."/config.php"; include_once dirname(__FILE__)."/$bmc_dir/main.php"; config.php -------------------------------------- $bmc_dir="bmc"; /K-159