#26119 [NEW]: Random SESSION-ID given in URL is accepted for the session

From: Date: Tue, 04 Nov 2003 19:04:24 +0000
Subject: #26119 [NEW]: Random SESSION-ID given in URL is accepted for the session
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-49977@lists.php.net to get a copy of this message 
From:             glattfahrservice at web dot de
Operating system: Windows XP Professional
PHP version:      4.3.4
PHP Bug Type:     Session related
Bug description:  Random SESSION-ID given in URL is accepted for the session

Description:
------------
Normally PHP is using some clever algorithms to provide for safe and
unique SESSION-IDs. However, when a simple session-id is passed to the
script in which session_start() is called, a session with the given ID is
generated.

e.g.: www.test.com/index.php&PHPSESSID=blabla

should not be accepted and a new SESSION-ID should be generated for the
session. BUT: this session-ID (blabla) is obviously valid and not
rejected.

Functionality is not impaired, but right now a visitor is able to "choose"
his own session-id. Not very safe, right?

I have disabled cookies and turned off trans-sid.

Ciao,
Dan.


-- 
Edit bug report at http://bugs.php.net/?id=26119&edit=1
-- 
Try a CVS snapshot (php4):  http://bugs.php.net/fix.php?id=26119&r=trysnapshot4
Try a CVS snapshot (php5):  http://bugs.php.net/fix.php?id=26119&r=trysnapshot5
Fixed in CVS:               http://bugs.php.net/fix.php?id=26119&r=fixedcvs
Fixed in release:           http://bugs.php.net/fix.php?id=26119&r=alreadyfixed
Need backtrace:             http://bugs.php.net/fix.php?id=26119&r=needtrace
Try newer version:          http://bugs.php.net/fix.php?id=26119&r=oldversion
Not developer issue:        http://bugs.php.net/fix.php?id=26119&r=support
Expected behavior:          http://bugs.php.net/fix.php?id=26119&r=notwrong
Not enough info:            http://bugs.php.net/fix.php?id=26119&r=notenoughinfo
Submitted twice:            http://bugs.php.net/fix.php?id=26119&r=submittedtwice
register_globals:           http://bugs.php.net/fix.php?id=26119&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=26119&r=php3
Daylight Savings:           http://bugs.php.net/fix.php?id=26119&r=dst
IIS Stability:              http://bugs.php.net/fix.php?id=26119&r=isapi
Install GNU Sed:            http://bugs.php.net/fix.php?id=26119&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=26119&r=float

Thread (5 messages)

« previous php.bugs (#49977) next »