CVE:CVE-2008-3770
CNNVD:CNNVD-200808-296
Freeway是一款开源的电子商务平台系统。
Freeway 1.4.1.171版本存在多个目录遍历漏洞。
当register_globals被激活时，远程攻击者可以借助语言参数中的".."，放入和运行任意的本地文件。
(1) includes/events_application_top.php(2)english/account.php, (3) french/account.php(4) french/account_newsletters.php in includes/languages/(5)includes/modules/faqdesk/faqdesk_article_require.php;(6)includes/modules/newsdesk/newsdesk_article_require.php(7) card1.php(8) loginbox.php(9)whos_online.php in templates/Freeway/boxes  (10) templates/Freeway/mainpage_modules/mainpage.php均存在该漏洞。
solution:Upgrade openfreeway freeway to a higher version than 1.4.1.171,and avoid the version 1.4.1.171