Re: PHP session management

[Tommy Gildseth <gildseth () start no>]

Gavin Zuchlinski wrote:
> Hi,
> I noticed on a server how PHP creates files in /tmp in the form sess_XXXXXXXXX 
> to store session information (of course only readable by the apache user), 

This isn't really a problem to bypass. If someones got local access, 
it's likely they will have access to some sort of webfolder, wether that 
be a virtualhost, or homedirs(www.foo.com/~username), you can easily 
access the information stored in the session with a script like this:

<?php
session_start();
print_r($_SESSION);
?>

And accessing that script with: sesscontent.php?PHPSESSID=<session_id>

PHP doesn't seem to maintain any information about which users webarea 
"owns" the session.

> but "XXXXXXXXX" is the actual session ID. If a person has a local access to a 
> system using PHP's session management, aren't they able to hijack any 
> session? 

Yes, they can.