CVE-2006-2046 EXPLOIT
6.4
MEDIUM · CVSS 2.0 · EPSS 4% (pctl 90)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) keywords parameters in (a) Results.cfm, and the (3) ProdID parameter in (b) Details.cfm.
Scoring
| CVSS | 6.4 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
| EPSS | 4.05% — more likely to be exploited than 90% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-04-26 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| application dynamics | cartweaver coldfusion |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Cartweaver 2.16.11 - 'ProdID' SQL Injection | 2007-08-06 |
| exploit-db | Cartweaver 2.16.11 - 'Results.cfm' SQL Injection | 2006-04-25 |
References
- http://pridels0.blogspot.com/2006/04/cartweaver-coldfusion-vuln.html
- http://secunia.com/advisories/19812
- http://www.osvdb.org/24961
- http://www.osvdb.org/24962
- http://www.securityfocus.com/bid/17941
- http://www.securityfocus.com/bid/25210
- http://www.techfeed.net/blog/index.cfm/2006/4/26/cartweaver-holes
- http://www.vupen.com/english/advisories/2006/1513
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26060
- https://www.exploit-db.com/exploits/4264
- http://pridels0.blogspot.com/2006/04/cartweaver-coldfusion-vuln.html
- http://secunia.com/advisories/19812
- http://www.osvdb.org/24961
- http://www.osvdb.org/24962
- http://www.securityfocus.com/bid/17941
- http://www.securityfocus.com/bid/25210
- http://www.techfeed.net/blog/index.cfm/2006/4/26/cartweaver-holes
- http://www.vupen.com/english/advisories/2006/1513
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26060
- https://www.exploit-db.com/exploits/4264
→ the Explorer · watch your stack · NVD