1. CVE-Search
  2. CVE-2006-0636
ID CVE-2006-0636
Summary desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable before calling the session_start function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other attacks by modifying critical assumed-immutable variables, as demonstrated using PHP code in the _SESSION[apps][eyeOptions.eyeapp][wrapup] variable.
References
Vulnerable Configurations
  • cpe:2.3:o:eyeos_project:eyeos:0.8:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.1:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.1:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.1_r1:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.1_r1:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.2:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.2:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.2_r1:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.2_r1:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.2_r2:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.2_r2:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.2_r3:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.2_r3:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.3:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.3:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.3_r1:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.3_r1:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.3_r2:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.3_r2:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.4:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.4_r1:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.4_r1:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.5:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.5:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.5_r1:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.5_r1:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.6:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.7:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.7:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.8:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.8:*:*:*:*:*:*:*
  • cpe:2.3:o:eyeos_project:eyeos:0.8.9:*:*:*:*:*:*:*
    cpe:2.3:o:eyeos_project:eyeos:0.8.9:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 19-10-2018 - 15:45)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 16537
bugtraq 20060207 eyeOS <= 0.8.9 Remote Code Execution
misc http://www.gulftech.org/?node=research&article_id=00096-02072006
sectrack 1015609
secunia 18757
sreason 419
vupen ADV-2006-0466
xf eyeos-desktop-file-include(24569)
Last major update 19-10-2018 - 15:45
Published 10-02-2006 - 11:02
Last modified 19-10-2018 - 15:45
Back to Top