WebApp Sec: Re: PHP session management

From: Tommy Gildseth <gildseth_at_start.no>
Date: Sun, 26 Oct 2003 15:06:35 +0100

Gavin Zuchlinski wrote:
> Hi,
> I noticed on a server how PHP creates files in /tmp in the form sess_XXXXXXXXX
> to store session information (of course only readable by the apache user),

This isn't really a problem to bypass. If someones got local access,
it's likely they will have access to some sort of webfolder, wether that
be a virtualhost, or homedirs(www.foo.com/~username), you can easily
access the information stored in the session with a script like this:

<?php
session_start();
print_r($_SESSION);
?>

And accessing that script with: sesscontent.php?PHPSESSID=<session_id>

PHP doesn't seem to maintain any information about which users webarea
"owns" the session.

> but "XXXXXXXXX" is the actual session ID. If a person has a local access to a
> system using PHP's session management, aren't they able to hijack any
> session?

Yes, they can.
Received on Oct 26 2003