PHP session management

Hi,
I noticed on a server how PHP creates files in /tmp in the form sess_XXXXXXXXX
to store session information (of course only readable by the apache user),
but "XXXXXXXXX" is the actual session ID. If a person has a local access to a
system using PHP's session management, aren't they able to hijack any
session? Am I a complete moron and am missing something?
And that aside, are there any other known problems with using PHP sessions
(besides all the standard PHP security issues like variable access)?

-Gavin
http://libox.net/
Received on Oct 26 2003