AjaxSearch vulnerability 'ucfg' Parameter Arbitrary File Access

        $config = parseUserConfig((strip_tags($_POST['ucfg'])));
        // Load the custom functions of the custom configuration file if needed
        if ($config) {
            $lconfig = (substr($config, 0, 6) != "@FILE:") ? AS_PATH . "configs/$config.config.php" : $modx->config['base_path'] . trim(substr($config, 6, strlen($config)-6));
            if (file_exists($lconfig)) include $lconfig;