CVE:CVE-2006-0922
CNNVD:CNNVD-200602-429
CubeCart 3.0到3.6没有正确检查对管理会话的授权，是因为一个缺失的auth.inc.php包含文件，这会在connector.php(即upload.php)的FileUpload中导致绝对路径遍历漏洞，从而可使远程攻击者借助对admin/filemanager/upload.php的直接请求中经过修改的CurrentFolder参数上传任意文件。
solution:Upgrade devellion cubecart to a higher version than 3.0.0_alpha,3.0.0_alpha-2,3.0.0_alpha-rgf,3.0.0_beta,3.0.0_final,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6,and avoid the version 3.0.0_alpha,3.0.0_alpha-2,3.0.0_alpha-rgf,3.0.0_beta,3.0.0_final,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6