[VIM] false? AN Guestbook LFI

Steven M. Christey coley at linus.mitre.org
Fri Jun 26 00:44:32 UTC 2009


Researcher: CraCkEr

http://www.milw0rm.com/exploits/9013


The source code for 0.7.8 says:

   if (__FILE__ == $_SERVER['SCRIPT_FILENAME'])
        die("This file cannot be executed directly");
   include_once ("languages/$g_lang");

which seems to prevent direct request in my environment.

This code is in 0.7 as well.  The file doesn't exist in 0.6.

- Steve


More information about the VIM mailing list