CVE-2006-4433 Code injection in n/a
Remote attackers can inject PHP code into session identifiers when using third-party session handlers, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-4433?
CVE-2006-4433 is a high-severity code injection vulnerability in Php Php, published on 29 Aug 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file. NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation.
Which versions are affected by CVE-2006-4433?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2006-4433?
No fix has been published for CVE-2006-4433 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2006-4433 being exploited?
There is no known exploitation of CVE-2006-4433 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-pv44-wwg7-676g.