CVE-2006-4433
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2006-4433
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file. NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
PHP 第三方会话句柄的会话标识符设计限制
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PHP 4.4.3之前版本和5.1.4之前的5.x版本没有对第三方会话句柄的会话标识符(PHPSESSID) 的字符集进行限制，这样，远程攻击者通过将PHP代码插入到存储在会话文件中的会话标识符PHPSESSID中，从而利用其它漏洞会更加容易实现。注：此问题在PHP内部并不属于漏洞，而是一种设计限制，但这一观点存在争议。致使某些抵制会话句柄的攻击得以存在，便不能为这种限制做出解释。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2006-4433
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2006-4433
请登录查看更多情报信息。
- http://www.hardened-php.net/advisory_052006.128.htmlx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2006-4433
Same Patch Batch · n/a · 2006-08-29 · 23 CVEs total
| CVE-2006-4425 | phpCOIN 多个PHP远程文件包含漏洞 | |
| CVE-2006-4436 | OpenBSD isakmpd工具 ISAKMPD IPsec通信会话回放漏洞 | |
| CVE-2006-4435 | OpenBSD semaphore分配拒绝服务漏洞 | |
| CVE-2006-4434 | Sendmail超长邮件头释放后使用(use-after-free)漏洞 | |
| CVE-2006-4432 | Zend Platform final组件目录遍历漏洞 | |
| CVE-2006-4431 | Zend Platform平台多个缓冲区溢出漏洞 | |
| CVE-2006-4430 | Cisco NAC代理安装安全绕过漏洞 | |
| CVE-2006-4429 | PHlyMail Lite 'mod.listmail.php'PHP远程文件包含漏洞 | |
| CVE-2006-4428 | Jupiter CMS 'Index.PHP'.PHP远程文件包含漏洞 | |
| CVE-2006-4427 | eFiction 'Index.PHP'认证绕过漏洞 | |
| CVE-2006-4426 | AlberT-EasySite 'logout.php' PSA_PATH远程文件包含漏洞 | |
| CVE-2006-4439 | Sun Solaris pkgmap文件mode字段安全权限漏洞 | |
| CVE-2006-4424 | PhpCOIN多个远程文件包含漏洞 | |
| CVE-2006-4423 | Bigace Globals参数多个远程文件包含漏洞 | |
| CVE-2006-4422 | Jetbox CMS 'Search_function.PHP'远程文件包含漏洞 | |
| CVE-2006-4421 | Yapig 'Thanks_comment.PHP'跨站脚本攻击漏洞 | |
| CVE-2006-4445 | CuteNews 多个PHP远程文件包含漏洞 | |
| CVE-2006-4444 | Cybozu Garoon 多个SQL注入漏洞 | |
| CVE-2006-4443 | AlstraSoft Video Share Enterprise 'MyajaxPHP.PHP'远程文件包含漏洞 | |
| CVE-2006-4442 | PHP iAddressBook Cat_Name参数跨站脚本攻击(XSS)漏洞 |
Showing top 20 of 23 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
- CVE-2026-8276
bettercap MySQL Server mysql_server.go integer coercion - CVE-2026-8275
bettercap zerogod IPP Service zerogod_ipp_primitives.go ippR - CVE-2026-8270
Open5GS SMF ogs_nas_parse_qos_rules denial of service - CVE-2026-8269
Open5GS SMF smf_nsmf_handle_create_sm_context denial of serv - CVE-2026-8268
Open5GS SMF OpenAPI_list_create denial of service
V. Comments for CVE-2006-4433
No comments yet