CVE-2006-6383

published 2006-12-10

CVE-2006-6383: PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path…

Priority P4 16 medium 4.6 CVSS 2.0

AV L AC L Au N C P I P A P

EXPLOIT

PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path.

Affected

69 ranges · showing 25

Vendor	Product	Version range	Fixed in
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—

CVSS provenance

nvd v2.0 4.6 MEDIUM AV:L/AC:L/Au:N/C:P/I:P/A:P

vendor_redhat 4.6 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20