CVE-2006-0636

Published: Feb 10, 2006Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable before calling the session_start function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other attacks by modifying critical assumed-immutable variables, as demonstrated using PHP code in the _SESSION[apps][eyeOptions.eyeapp][wrapup] variable.

Affected (18)

Products: Eyeos Project: Eyeos

Eyeos Project

1 product

Eyeos

Configuration A

18 vulnerable

Vulnerable Software	Affected Versions
Eyeos Project Eyeos	Version 0.8.1
Eyeos Project Eyeos	Version 0.8.1_r1
Eyeos Project Eyeos	Version 0.8.2
Eyeos Project Eyeos	Version 0.8.2_r1
Eyeos Project Eyeos	Version 0.8.2_r2
Eyeos Project Eyeos	Version 0.8.2_r3
Eyeos Project Eyeos	Version 0.8.3
Eyeos Project Eyeos	Version 0.8.3_r1
Eyeos Project Eyeos	Version 0.8.3_r2
Eyeos Project Eyeos	Version 0.8.4
Eyeos Project Eyeos	Version 0.8.4_r1
Eyeos Project Eyeos	Version 0.8.5
Eyeos Project Eyeos	Version 0.8.5_r1
Eyeos Project Eyeos	Version 0.8.6
Eyeos Project Eyeos	Version 0.8.7
Eyeos Project Eyeos	Version 0.8.8
Eyeos Project Eyeos	Version 0.8.9
Eyeos Project Eyeos	Version 0.8