G00db0y has reported a vulnerability in ShopCartCGI, allowing malicious people to view arbitrary files.

The problem is that multiple scripts fail to verify input properly. This can be exploited to supply arbitrary paths to various files using the classical directory traversal character sequence "../".

This has been reported to affect version 2.3.

Solution
Use a proxy or firewall with URL filtering capabilities to filter malicious requests.

Provided and/or discovered by
G00db0y from Zone-h Security Labs

Original Advisory
http://www.zone-h.org/en/advisories/read/id=3962/

Deep Links
Links available to Secunia VIM customers