Full path disclosure and sql injection on CubeCart 2.0.1

[Behrooz_Ice]

A remote user can cause an error in index.php using the parameter 'cat_id' which is not properly validated, displaying the software's full installation path. It can also be used to inject sql commands. Enjoy!