Well, I had to call it something. File system DBs were a problem long before FoxPro’s DBCs, yes. Yes, it’s an architectural decision. Sharp cookies would just modify the files directly. But that would just trash data (or bump my hourly rate in the HR DB). Most of the time, “full access to data” doesn’t necessarily mean “run arbitrary code”. In this case, it does, which I don’t think folks expect, hence “hole”.
> Well, I had to call it something.
A significant weakness?
A serious limitation for modern uses / in modern environments?
There's a category in the OWASP Top 6, called: Insecure Design.
It is top 6 in their vulnerabilities ranking.
This is definitely insecure design.