CVEvulnerability

CVE-2006-0636

7.5 HIGH Published 2006-02-10 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-02-10
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable before calling the session_start function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other attacks by modifying critical assumed-immutable variables, as demonstrated using PHP code in the _SESSION[apps][eyeOptions.eyeapp][wrapup] variable.

Affected configurations

• eyeos project eyeos 0.8 • eyeos project eyeos 0.8.1 • eyeos project eyeos 0.8.1 r1 • eyeos project eyeos 0.8.2 • eyeos project eyeos 0.8.2 r1 • eyeos project eyeos 0.8.2 r2 • eyeos project eyeos 0.8.2 r3 • eyeos project eyeos 0.8.3 • eyeos project eyeos 0.8.3 r1 • eyeos project eyeos 0.8.3 r2 • eyeos project eyeos 0.8.4 • eyeos project eyeos 0.8.4 r1 • eyeos project eyeos 0.8.5 • eyeos project eyeos 0.8.5 r1 • eyeos project eyeos 0.8.6 • eyeos project eyeos 0.8.7 • eyeos project eyeos 0.8.8 • eyeos project eyeos 0.8.9

References