[VIM] vendor ACK for phpTrafficA issues

[Steven M. Christey]

Ref: MILW0RM:4100
Researcher: laurent gaffie


from 1.4.3, released on June 25 2007:

  http://soft.zoneo.net/phpTrafficA/Files/get.php?phpTrafficA-1.4.3.tgz

changes.html says:

   Input passed to the lang parameter in index.php was not properly
   verified before being used to include files and could be exploited
   to include arbitrary files from local resources. It is now fixed.

   Input passed to the pageid parameter in index.php was not properly
   sanitised before being used in SQL queries. This could be exploited
   to manipulate SQL queries by injecting arbitrary SQL code. It is
   now fixed.

   Input passed to the lang parameter in index.php was not properly
   sanitised before being returned to the user and could be exploited
   to execute arbitrary HTML and script code in a user's browser
   session in context of an affected site.

So, these issues are distinct from CVE-2007-1076, which itself is
ACK'ed in the changelog entry for 1.4.2.

- Steve