CVE-2006-4433

CVE-2006-4433 describes a design limitation in PHP versions prior to 4.4.3 and 5.1.4, where the session identifier (PHPSESSID) for third-party session handlers lacks character set restrictions. This oversight could allow remote attackers to inject PHP code into the PHPSESSID, which is then stored in session files, potentially enabling the exploitation of other vulnerabilities. With a CVSS score of 7.5, this vulnerability is considered highly severe, allowing for network-based attacks with low complexity that could lead to partial compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.