PHP Safe Programming: Session Data Injection_PHP Tutorial

PHP Secure Programming: Session Data Injection

A similar problem to session exposure is session injection. This type of attack is based on your WEB server not only having read permissions to the session storage directory, but also having write permissions. Therefore, it is possible to write a script that allows other users to add, edit or delete sessions. The following example shows an HTML form that allows users to easily edit existing session data:

<!--?php

session_start();

?-->

The script inject.php performs the modifications specified by the form:

<!--?php

session_start();

$path = ini_get(&#39;session.save_path&#39;);

foreach ($_POST as $sess_name =--> $sess_data)
{
  $_SESSION = $sess_data;
  $sess_data = session_encode;

  file_put_contents($path/$sess_name, $sess_data);
}

$_SESSION = array();

?>

This type of attack is extremely dangerous. An attacker can edit not only your users' data, but also his own session data. It is more powerful than session hijacking because the attacker can select all session data for modification, making it possible to bypass access restrictions and other security measures.

The best solution to this problem is to save the session data in a database. See earlier in the topic.

Extended reading

http://www.bkjia.com/PHPjc/876631.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/876631.htmlTechArticlePHP Secure Programming: Session Data Injection A similar problem to session exposure is session injection. This type of attack is based on your WEB server not only having read permissions to the session storage directory, but also...