CVE:CVE-2008-0736
CNNVD:CNNVD-200802-209
CandyPress (CP)的admin/SA_shipFedExMeter.asp允许远程攻击者借助FedExAccount参数的某一个确定值获取路径。
solution:Upgrade shoppingtree candypress_store to a higher version than 4.1,4.1.1.26,and avoid the version 4.1,4.1.1.26