CVE-2006-0922
- State
- Published
- Severity
- Not scored
- Published
- Feb 28, 2006
- Updated
- Aug 7, 2024
- Reserved
- Feb 28, 2006
Description
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://www.cubecart.com/site/forums/index.php?showtopic=14972
- http://www.cubecart.com/site/forums/index.php?showtopic=14960
- cubecart-connector-file-include(24883)vdb-entry
- 482third-party-advisory
- 20060223 NSA Group Security Advisory NSAG-¹197-23.02.2006 Vulnerability CubeCart 3.0.0 ? 3.0.6mailing-list
- http://www.cubecart.com/site/forums/index.php?showtopic=14817
- 16796vdb-entry
- http://www.cubecart.com/site/forums/index.php?showtopic=14825
- http://www.cubecart.com/site/forums/index.php?showtopic=14704
- http://www.nsag.ru/vuln/892.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.