CVE-2006-0636

CVE-2006-0636 describes a critical vulnerability in eyeOS versions 0.8.9 and earlier, where the desktop.php script improperly checks for the _SESSION variable before initializing the session. This flaw allows remote attackers to inject and execute arbitrary PHP code by manipulating the _SESSION[apps][eyeOptions.eyeapp][wrapup] variable. With a CVSS score of 7.5, this vulnerability is considered highly severe due to its network-based attack vector, low attack complexity, and potential for full compromise of confidentiality, integrity, and availability. Despite its age and severity, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage.