Skip to content

GitLab

Closed
Opened by Andrew Bartlett@abartlet

[SECURITY] Session::__construct() allows use of the current time as a session key

inc/Session.php uses this SQL, to try and limit session use to those in possession of the session key:

    $sql .= " WHERE session.session_id = ? AND (md5(session.session_start::text) = ? OR session.session_key = ?) ORDER BY session.session_start DESC LIMIT 2";

However there is a fatal flaw in the logic. It allows anyone who can guess the microsecond time (and the incrementing session_id) to impersonate the session.

The (md5(session.session_start::text) = ? OR clause should be removed.