[VIM] Pluck Local File Inclusion

[str0ke]

George A. Theall wrote:
> Has anyone looked at the advisory about local file include issues in
> Pluck (BID 30218 /
> http://archives.neohapsis.com/archives/bugtraq/2008-07/0106.html)? It
> seems like the issues aren't generally exploitable if you call the
> affected script directly since the directories embedded in calls to
> include() -- "data/inc/lang", "data/content", and "data/blog" -- are
> located at the base of the application's install directory rather than
> under "data/inc/themes". Or do I just mis-understand how PHP sets the
> current working directory when calling a script?

Your right it shouldn't work, but under windows its a different story
(at least was in the past). 

I believe its like so.

# *nix
ls -la data/../../../../../../etc/passwd << won't work if the data
directory doesn't exist.

# win
dir data\..\..\..\..\..\..\boot.ini << works with or without the directory.

/str0ke