NetSight
IP …
medium6.4Public exploit code

CVE-2010-1128

The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to gu…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.

Affected products

VendorProductAffected versions
PhpPhp
through 5.2.12
Versions 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4

Weakness classification

CWE-310

References