PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session…

Description

PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file. NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation.

Scores

EPSS (exploitation in 30 days)

1.8% · top 21% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (7)

• 28233 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 20060824 Advisory 05/2006: Zend Platform Multiple Remote Vulnerabilities (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 1466 (opens in a new tab)third-party-advisoryx_refsource_SREASONx_transferred
• 28273 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• http://www.hardened-php.net/advisory_052006.128.html (opens in a new tab)x_refsource_MISCx_transferred
• 21573 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-3388 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-4433](https://trackcve.app/badge/CVE-2006-4433.svg)](https://trackcve.app/cve/CVE-2006-4433)

Record last updated 7 Aug 2024, 19:06 UTC.