vegadns vulnerable to command injection

[Eldar Marcussen]

axfr_get.php does not escape the file variable, proof of concept available at: https://github.com/wireghoul/sploit-dev/blob/master/izunadrop

[Bill Shupp]

Thanks for reporting and the POC. This is fixed in 0.13.3.