Exploitation Summary
EIP tracks 1 public exploit for CVE-2006-3105. PoCs published by rgod.
AI-analyzed exploit summary This exploit targets a file upload vulnerability in bitweaver <= v1.3, allowing remote code execution by uploading a malicious file with a double extension (e.g., suntzu.php.xxx) to the temp/articles/ directory. The exploit leverages a race condition to execute commands before the temporary file is deleted.
Description
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
Exploits (1)
This exploit targets a file upload vulnerability in bitweaver <= v1.3, allowing remote code execution by uploading a malicious file with a double extension (e.g., suntzu.php.xxx) to the temp/articles/ directory. The exploit leverages a race condition to execute commands before the temporary file is deleted.