VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 29, 2006· Updated Jun 16, 2026

CVE-2006-4433

CVE-2006-4433

Description

PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file. NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

66
  • PHP/PHP66 versions
    cpe:2.3:a:php:php:4.0:*:*:*:*:*:*:*+ 65 more
    • cpe:2.3:a:php:php:4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.1:patch1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.1:patch2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.3:patch1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.4:patch1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.7:rc1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.7:rc2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.7:rc3:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:beta4:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:beta_4_patch1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2:*:dev:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.0:beta4:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.0:rc3:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0:rc3:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*
    • (no CPE)range: before 4.4.3 and before 5.1.4

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.