[VIM] true w/caveat: GeekLog glConf[path_libraries] RFI
Steven M. Christey
coley at mitre.org
Wed Feb 7 01:02:00 EST 2007
In the Geeklog distribution, we have the following from
require $glConf['path_libraries'] . 'Geeklog/MVCnPHP/ViewInterface.php';
which is the first statement.
However, this comes from some package called "MVCnPHP" which has some
close relationship with Geeklog but is separate:
which says "MVCnPHP stands for Model-View-Controller in PHP. It is an
implementation of the MVC design pattern for use in PHP applications."
... and downloading 3.0.0 of this MVCnPHP produces a BaseView.php
which, upon removing spaces and CRLF inconsistencies, is exactly the
same as that which is in Geeklog.
So we can add this to our list of modules whose ease-of-integration
makes opportunities for ease-of-exploitation. Whether the blame lies
with Geeklog or MVCnPHP is not immediately clear.
More information about the VIM