Cubecart · Cubecart · CVE-2005-1033
**Name of the Vulnerable Software and Affected Versions**
CubeCart version 2.0.6
**Description**
The issue allows remote attackers to obtain sensitive information via various invalid parameters to different PHP files, including the `language` parameter to "index.php", the `PHPSESSID` parameter to "index.php", the `product` parameter to "tellafriend.php", the `add` parameter to "view cart.php", or the `product` parameter to "view product.php". This reveals the path in a PHP error message.
**Recommendations**
For CubeCart version 2.0.6, consider restricting access to the mentioned PHP files or validating the `language`, `PHPSESSID`, `product`, and `add` parameters to prevent the disclosure of sensitive information. As a temporary workaround, consider disabling the display of PHP error messages to minimize the risk of path disclosure.