CVE-2006-0922: Path Traversal
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0922?
CVE-2006-0922 has been classified with a significant severity due to its potential for unauthorized file uploads.
How do I fix CVE-2006-0922?
To mitigate CVE-2006-0922, ensure proper authorization checks are implemented and update the CubeCart installation to the latest version.
What versions of CubeCart are affected by CVE-2006-0922?
CVE-2006-0922 impacts CubeCart versions from 3.0.0 to 3.0.6.
Can CVE-2006-0922 allow remote code execution?
Yes, CVE-2006-0922 could potentially allow remote attackers to execute arbitrary code through file uploads.
What is the cause of CVE-2006-0922?
The vulnerability in CVE-2006-0922 is caused by a missing auth.inc.php include which leads to improper authorization checks.