Known php session, what else can be pulled out of the site? And how can you protect yourself?

Question

PHP

The guys asked to analyze the site, found a file in which PHPSESSION is duplicated for some reason, what can I get if I know this parameter? If you replace it with an authorized session, then the site looks like you are authorized and writes basic account information. What else can be done?
And as I understand it, you can protect yourself in 2 ways to record a session in a file by coding + deny access to the file.

Answer 1

If you change the session, you can access everything that the user can do and see while logging in.
There are several ways to protect yourself, depending on how critical information an attacker can get and how dangerous actions he can perform.
And yes, what kind of file did you find such? This, by chance, is not the one in which PHP, in fact, writes its sessions? If not, then such a file is not needed. If so, then in the order of paranoia, you can restrict access to it at the file system level, but in general it is enough that there is no access from the web.

Answer 2

If the session is your own / only your own is visible, then there is nothing dangerous. (We kind of know it anyway by opening cookies)
You can substitute someone else's session on any site and in 99% of cases it will work as you described.
You should first learn something yourself, and then analyze other people's sites.