medium5.0Public exploit code
CVE-2006-3105
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Bitweaver 1.3 - 'tmpImagePath' Attachment mod_mime2006-06-15 · webapps · php · Verified
Impact
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bitweaver | Bitweaver | Version 1.3 |
References
- NVD record
- CVE.org record
- http://retrogod.altervista.org/bitweaver_13_xpl.html
- http://securityreason.com/securityalert/1115
- http://sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358
- http://www.bitweaver.org/articles/45
- http://www.osvdb.org/26590
- http://www.securityfocus.com/archive/1/437491/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27348
- http://retrogod.altervista.org/bitweaver_13_xpl.html
- http://securityreason.com/securityalert/1115
- http://sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358
- http://www.bitweaver.org/articles/45
- http://www.osvdb.org/26590
- http://www.securityfocus.com/archive/1/437491/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27348