Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors related to \certain characters in session names \ including special characters that are frequently associated with CRLF injection SQL injection cross-site scripting (XSS) and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric as implied in the PHP manual for session_name().