CVE-2006-2046 Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) keywords....
MediumCVSS 6.4
EPSS 4.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) keywords parameters in (a) Results.cfm, and the (3) ProdID parameter in (b) Details.cfm.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| application dynamics cartweaver coldfusion | <= 2.16.11 | No fix listed |
References
- pridels0.blogspot.com
- 19812 third-party-advisory
- 24961 vdb-entry
- 24962 vdb-entry
- 17941 vdb-entry
- 25210 vdb-entry
- www.techfeed.net
- ADV-2006-1513 vdb-entry
- cartweaver-multiple-sql-injection(26060) vdb-entry
- 4264 exploit