Lucene search

MitreCVE-2006-2046

HistoryApr 26, 2006 - 8:06 p.m.

CVE-2006-2046

2006-04-2620:06:00

mitre

web.nvd.nist.gov

sql injection

application dynamics

cartweaver

coldfusion

security vulnerability

remote execution

nvd

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

AI Score

8.4

Confidence

Low

EPSS

0.009

Percentile

82.6%

JSON

Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) keywords parameters in (a) Results.cfm, and the (3) ProdID parameter in (b) Details.cfm.

Affected configurations

Nvd

Node

application_dynamicscartweaver_coldfusionRange≤2.16.11

VendorProductVersionCPE
application_dynamicscartweaver_coldfusion*cpe:2.3:a:application_dynamics:cartweaver_coldfusion:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
application_dynamics	cartweaver_coldfusion	*	cpe:2.3:a:application_dynamics:cartweaver_coldfusion::::::::

References

pridels0.blogspot.com/2006/04/cartweaver-coldfusion-vuln.html

secunia.com/advisories/19812

www.osvdb.org/24961

www.osvdb.org/24962

www.securityfocus.com/bid/17941

www.securityfocus.com/bid/25210

www.techfeed.net/blog/index.cfm/2006/4/26/cartweaver-holes

www.vupen.com/english/advisories/2006/1513

exchange.xforce.ibmcloud.com/vulnerabilities/26060

www.exploit-db.com/exploits/4264

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

AI Score

8.4

Confidence

Low

EPSS

0.009

Percentile

82.6%

JSON

Related for CVE-2006-2046