Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
PHP LCG不充分熵漏洞
Vulnerability Description
PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的LCG(线性同余生成器)所生成的随机会话ID或随机数随机性不够强，初始种子可能由64位降低为35位，通过执行PHP代码还可以进一步降低为20位，这就大大的降低了确定伪随机数序列的复杂度，用户可以相对容易的窃取会话ID或其他敏感信息。
CVSS Information
N/A
Vulnerability Type
N/A