Strix
26.1K

CVE-2006-0636

UnknownEPSS 1.81%

Last modified

CVE-2006-0636 is a vulnerability of currently unknown severity. desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable before calling the session_start function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other attacks by modifying critical assumed-immutable variables, as demonstrated using PHP code in the _SESSION[apps][eyeOptions.eyeapp][wrapup] variable.. EPSS estimates a 1.81% chance of exploitation in the next 30 days.

Description

desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable before calling the session_start function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other attacks by modifying critical assumed-immutable variables, as demonstrated using PHP code in the _SESSION[apps][eyeOptions.eyeapp][wrapup] variable.

Metrics

EPSS Probability
1.81%

75.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
Eyeos ProjectEyeos0.8
Eyeos ProjectEyeos0.8.1
Eyeos ProjectEyeos0.8.1_r1
Eyeos ProjectEyeos0.8.2
Eyeos ProjectEyeos0.8.2_r1
Eyeos ProjectEyeos0.8.2_r2
Eyeos ProjectEyeos0.8.2_r3
Eyeos ProjectEyeos0.8.3
Eyeos ProjectEyeos0.8.3_r1
Eyeos ProjectEyeos0.8.3_r2
Eyeos ProjectEyeos0.8.4
Eyeos ProjectEyeos0.8.4_r1
Eyeos ProjectEyeos0.8.5
Eyeos ProjectEyeos0.8.5_r1
Eyeos ProjectEyeos0.8.6
Eyeos ProjectEyeos0.8.7
Eyeos ProjectEyeos0.8.8
Eyeos ProjectEyeos0.8.9

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2006-0636?
desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable before calling the session_start function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other attacks by modifying critical assumed-immutable variables, as demonstrated using PHP code in the _SESSION[apps][eyeOptions.eyeapp][wrapup] variable.
How severe is CVE-2006-0636?
Severity scoring for CVE-2006-0636 is pending analysis. The EPSS model estimates a 1.81% probability of exploitation in the next 30 days.
How do I fix CVE-2006-0636?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2006

View all 2006CVEs →

Are you affected by CVE-2006-0636?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST