CVE-2006-3105

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 2.7%

from disclosure to weapon0 days

Published on NVDJun 21

1st PoCJun 15

exploitation probability

2.7%top 15% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/1918

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://retrogod.altervista.org/bitweaver_13_xpl.html http://securityreason.com/securityalert/1115 https://exchange.xforce.ibmcloud.com/vulnerabilities/27348 http://sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358 http://www.bitweaver.org/articles/45 http://www.osvdb.org/26590 http://www.securityfocus.com/archive/1/437491/100/0/threaded