CVE-2006-0922

CubeCart 3.0–3.6 contains an absolute path traversal/arbitrary file upload vulnerability in the admin FileUpload path (connector.php/upload.php) due to a missing auth.inc.php include. An unauthenticated attacker can upload arbitrary files via a modified CurrentFolder in a direct request to admin/...