https://www.exploit-db.com/exploits/23266
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200312-430

DansieShoppingCart是一款在线购物系统。DansieShoppingCart没有正确处理用户提交请求，远程攻击者可以利用这个漏洞获得应用程序安装路径。由于程序包含的cart.pl脚本对用户提交的db参数缺少正确处理，提交非法数据可返回包含安装路径信息的错误消息给攻击者。攻击者可以利用这些信息进一步对系统进行攻击。

source: http://www.securityfocus.com/bid/8860/info

Dansie Shopping Cart is reported to be prone to path disclosre issue in the 'db' parameter of 'cart.pl' that may lead to an attacker gaining sensitive information about the installation path of the system.

Information gained by exploiting this attack may aid an attacker in launching further attacks against a vulnerable system.

http://www.example.com/cgi-bin/cart.pl?db='

来源:XF
名称:dansie-cartpl-path-disclosure(13461)
链接:http://xforce.iss.net/xforce/xfdb/13461
来源:BID
名称:8860
链接:http://www.securityfocus.com/bid/8860
来源:www.securiteam.com
链接:http://www.securiteam.com/securitynews/6T00T008KG.html
来源：NSFOCUS
名称：5574
链接：http://www.nsfocus.net/vulndb/5574