https://www.exploit-db.com/exploits/25098
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-104

CubeCart2.0.4内的index.php中的目录遍历漏洞使得远程攻击者可以通过language参数读取任意文件。

source: http://www.securityfocus.com/bid/12549/info
 
Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks.
 
The application is reportedly susceptible to a remote directory traversal vulnerability. A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory in the context of the server.
 
The application is also prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This may allow for theft of cookie-based authentication credentials or other attacks.
 
CubeCart 2.0.4 and prior versions are considered to be vulnerable to these issues. 

http://www.example.com/index.php?&language=../../../../../../../../etc/passwd

来源:BID
名称:12549
链接:http://www.securityfocus.com/bid/12549
来源:www.cubecart.com
链接:http://www.cubecart.com/site/forums/index.php?showtopic=5741
来源:SECUNIA
名称:14272
链接:http://secunia.com/advisories/14272
来源:XF
名称:cubecart-dotdot-directory-traversal(19322)
链接:http://xforce.iss.net/xforce/xfdb/19322
来源:BUGTRAQ
名称:20050406RE:[NOBYTES.COM:#6]CubeCart2.0.6-InformationDisclosure
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=111281888605580&w;=2
来源:BUGTRAQ
名称:20050214[NOBYTES.COM:#2]CubeCart2.0.4-MultipleVulnerabilities
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=110842125901191&w;=2