| Package | Affected versions | Patched versions |
|---|---|---|
| cubecart | = 3.0.0_alpha= 3.0.0_alpha-2= 3.0.0_alpha-rgf= 3.0.0_beta= 3.0.0_final= 3.0.1= 3.0.2= 3.0.3= 3.0.4= 3.0.5= 3.0.6 |
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free