#28681 [NEW]: session-hijacking

From: s dot lemke at infoworxx dot de Operating system: Linux 2.4.18 PHP version: 4.3.7 PHP Bug Type: Session related Bug description: session-hijacking Description: ------------ Hi ! I have an "phaenomen" which is so fantastic that I cannot believe it. General setup: one Domain using sessions (with name "abcsession") running under "www.abconline.de" another domain for testing (also with name "abcsession") running under "dev.abconline.de" under some circumstances, stored sessiondata will be changed and i can found data in $_SESSION, which i have never stored. An important fact seems to be, that both domains have the same top-level domain on the same machine (physically two different systems - one for development and testing) - another important fact is a not found image. It is definitely a php problem. Here is an test-url: http://dev.abconline.de/test/start.php4 after every Refresh the Session-Var changes !! (try it :-) and if I type the contents of the file in which the session-data is stored (/tmp/sess_xxxxx) there are variables, I have never stored. I have documented more Infos in the sample scripts. I know it sounds really fantastic - after a few years of php-development I have never seen anything like this.... Regards, Sebastian Reproduce code: --------------- ---- start.php4 ---- <? session_name('abcsession'); session_start(); $_SESSION['s_valid_register']=642536304; ?> <HTML> <HEAD> <META HTTP-EQUIV="refresh" content="0;URL=second.php4"> <TITLE></TITLE> </HEAD> <BODY> redirect to next page! </BODY> </HTML> ---- second.php4 ---- <? session_name('abcsession'); session_start(); echo "Session: ".$_SESSION['s_valid_register']."<BR>"; echo '<img src="not-found-image.gif">'; echo "<BR>"; echo "session-id: ".session_id()."<BR>"; ?> <BR> now refresh (f5) an see whats happening with the session var !!!<BR><BR> I took a look into my session-file - there were a lot of more vars in there<BR> i cannot explain from where the vars are...!? - look at the session-file<BR><BR> [....] Session-Data:<BR> <? while (list($key, $value)=each($_SESSION)) echo $key."=".$value."<BR>"; ?> Expected result: ---------------- the session-var 's_valid_register' must have after every refresh the same value. only one var (s_valid_register) should be stored in the session-data-file (/tmp/sess_xxx), but it is not the only one ! Actual result: -------------- after every refresh the value changes. hijacked data in the session. -- Edit bug report at http://bugs.php.net/?id=28681&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=28681&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=28681&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=28681&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=28681&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=28681&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=28681&r=needscript Try newer version: http://bugs.php.net/fix.php?id=28681&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=28681&r=support Expected behavior: http://bugs.php.net/fix.php?id=28681&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=28681&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=28681&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=28681&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=28681&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=28681&r=dst IIS Stability: http://bugs.php.net/fix.php?id=28681&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=28681&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=28681&r=float