CVE-2006-3016: XSS
Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for sessionname().
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3016?
CVE-2006-3016 is classified as having high severity due to the potential for various injection attacks.
How do I fix CVE-2006-3016?
To fix CVE-2006-3016, upgrade PHP to version 5.1.3 or later.
What are the attack vectors for CVE-2006-3016?
The attack vectors for CVE-2006-3016 include session name manipulations that can lead to CRLF injection, SQL injection, and XSS vulnerabilities.
Which versions of PHP are affected by CVE-2006-3016?
CVE-2006-3016 affects PHP versions prior to 5.1.3.
What types of vulnerabilities are related to CVE-2006-3016?
CVE-2006-3016 is related to vulnerabilities involving CRLF injection, SQL injection, XSS, and HTTP response splitting.