CVE-2006-3016 Other in n/a
Unspecified vulnerability in PHP session handling involving special characters, potentially enabling injection or response splitting attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-3016?
CVE-2006-3016 is a critical vulnerability in n/a, published on 14 Jun 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().
Which versions are affected by CVE-2006-3016?
It affects 1 product.
Products include Php Group Php.
How do I fix CVE-2006-3016?
Upgrade to a fixed version.
Is CVE-2006-3016 being exploited?
There is no known exploitation of CVE-2006-3016 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rrmc-m598-86rh.