BabyGekko before 1.2.4 allows PHP file inclusion.
BabyGekko before
Exploit
CVE-2012-5699
NVD
Refer to CVE-2012-5699 NVD advisory