Session overwrite in PHP through extract - PoC

README.MD

Exploit

• POST-ing a body containing _SESSION[secret]=1 will log you in, but only through the second extract.

index.php

<?php
	function isLoggedIn() {
		if (is_numeric($_SESSION["secret"])) {
			return true;
		}
		else {
			return false;
		}
	}

	function foo($post) {
		$retval =  extract($post);
		return $retval;
	}

	function printSession() {
		print("[+] Session contains:\n");
		ob_start();
		$result = var_export($_SESSION);
		$result = ob_get_clean();
		$result = preg_replace("/^/m", "[-] ", $result);
		print($result);
		print("\n");
		print("-------------------\n");
	}

	session_start();
	$_SESSION["someKey"] = 'someValue';

	print("[+] Session started\n");
	print("-------------------\n");

	printSession();

	print("[+] Check(0) if user is logged in: " . var_export(isLoggedIn(), true) . "\n");
	print("-------------------\n");

	print("[+] Extracting variables through function: " . foo($_POST) . "\n");
	print("-------------------\n");

	print("[+] Recheck(1) if user is logged in: " . var_export(isLoggedIn(), true) . "\n");
	print("-------------------\n");

	printSession();

	print("[+] Extracting variables directly: " . extract($_POST) . "\n");
	print("-------------------\n");

	print("[+] Recheck(2) if user is logged in: " . var_export(isLoggedIn(), true) . "\n");
	print("-------------------\n");

	printSession();

?>