mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code.