CVE-2006-4433

PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of
the session identifier (PHPSESSID) for third party session handlers, which
might make it easier for remote attackers to exploit other vulnerabilities
by inserting PHP code into the PHPSESSID, which is stored in the session
file. NOTE: it could be argued that this not a vulnerability in PHP
itself, rather a design limitation that enables certain attacks against
session handlers that do not account for this limitation.

Notes