Directory traversal vulnerability in Zen Cart 1.3.0.2 and earlier allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences in the typefilter parameter.
https://exchange.xforce.ibmcloud.com/vulnerabilities/28395
https://euvd.enisa.europa.eu/vulnerability/EUVD-2006-4208
http://www.vupen.com/english/advisories/2006/3283
http://www.securityfocus.com/bid/19543
http://www.gulftech.org/?node=research&article_id=00109-08152006