Behrooz_Ice
03-20-2004, 07:35 PM
PHPX fails to create a secure session management engine. A user can obtain a session by simply suppling a uid of the user in which they want to obtain the account from, and as long as their session is in the database, it will allow session hi-jacking to occur. Further-more it is concerning that the session id itself is generated by a simple auto increment field in the MySQL database, making it trivial for an attacker to steal a cookie. Enjoy!