The question of the security of writing data to the session without filtering in php?

Question

PHP

Hello!
On the one hand, I understand that it is necessary to filter all the data that the user can influence, without exception.
On the other hand, I would like an example of a real threat from writing data to a session, for example, by accessing an unfiltered _GET array (without a specific place of use - it is interesting that there is a vulnerability at the level of adding data, and not reading from the session):

Session::instance()->set('somedata', $_GET['somevar']);

PS: the question is purely for the sake of curiosity and has nothing to do with real projects.

Answer 1

On 98% of servers, PHP stores sessions in strictly defined folders (10 options in total, maximum), and in 99% with the name sess_[a-z0-9]+.
If you write unfiltered data to the session, you can save it to the server disk. for example, a web shell, and if there is a local-include vulnerability, it will be possible to execute it.
That is, by itself, writing arbitrary data to a session does not pose a threat, but can be used to exploit other vulnerabilities.
Usually includes log files (previously leaving malicious code there), but they are very often not readable with php rights.
But finding the path to the session file is very simple, which means it facilitates a potential hack.

Answer 2

There is a boundary beyond which all code considers data safe. When crossing the border, the data needs to be filtered. Specifically, with sessions in PHP, it can happen that if you decide to store them in the database, you will get an injection.

Answer 3

Here , read the item ==[2]== Sessions . Maybe it will help.

Answer 4

Yes, nothing terrible, it seems, should not happen, well, they will write any kind of kaku there, well, it will be stored there as a string. The question, of course, is how this line will be used later, but if at the record level, I think that everything is safe.
Another question is what to filter, everything is better at the input.

Answer 5

Depending on who will be your session handler (as an example php.ini - session.save_handler)
For example, if you decide to store session data in a Database, such as MySQL or Postgre, then it would be nice to filter the data from SQLinjection, in the session class itself or in request handler.