Directory traversal vulnerability in Mike Spice's My Classifieds (classifieds.cgi) before 1.3 allows remote attackers to overwrite arbitrary files via the category parameter.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2002-1581
http://www.securityfocus.com/bid/3855
http://www.kb.cert.org/vuls/id/181907