Description
PHP 4.0 through 4.1.1 stores session IDs in temporary files whose name contains the session ID, which allows local users to hijack web connections.
References
- 3873 vdb-entry
- php-session-temp-disclosure(7908) vdb-entry
- 20020113 PHP 4.x session spoofing mailing-list