I'm going to assume the "ultra hackable" is thanks to requesting '../../phpmyadmin/config.php' or whatever. Oddly enough, I can't easily see any way to load a

I'm going to assume the "ultra hackable" is thanks to requesting '../../phpmyadmin/config.php' or whatever. Oddly enough, I can't easily see any way to load a random (system-level) python module, thanks to including the 'app' package explicitly in the load_module - IIRC you can't resolve imports outside a top-level package.