/ 
CGI-Session-4.10
Security Advisories (2)
CPANSA-CGI-Session-2006-01 (2006-04-06)

possible SQL injection attack

CVE-2026-56016 (2026-07-01)

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl's rand() is unsuitable for security purposes because it is predictable and reversible. An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.

Changes for version 4.10

  • SECURITY: Hopefully this settles all of the problems with symlinks. Both the file and db_file drivers now use O_NOFOLLOW with open when the file should exist and O_EXCL|O_CREAT when creating the file. Tests added for symlinks. (Matt LeBlanc)
  • SECURITY: sqlite driver no longer attempts to use /tmp/sessions.sqlt when no Handle or DataSource is specified. This was a mistake from a security standpoint as anyone on the machine would then be able to create and therefore insert data into your sessions. (Matt LeBlanc)
  • NEW: name is now an instance method (RT#17979) (Matt LeBlanc)

Modules

CGI::Session
persistent session data in CGI applications
CGI::Session::Driver
CGI::Session driver specifications
CGI::Session::Driver::DBI
Base class for native DBI-related CGI::Session drivers
CGI::Session::Driver::db_file
CGI::Session driver for BerkeleyDB using DB_File
CGI::Session::Driver::file
Default CGI::Session driver
CGI::Session::Driver::mysql
CGI::Session driver for MySQL database
CGI::Session::Driver::postgresql
PostgreSQL driver for CGI::Session
CGI::Session::Driver::sqlite
CGI::Session driver for SQLite
CGI::Session::ErrorHandler
error handling routines for CGI::Session
CGI::Session::ID::incr
CGI::Session ID driver
CGI::Session::ID::md5
default CGI::Session ID generator
CGI::Session::ID::static
CGI::Session ID Driver for generating static IDs
CGI::Session::Serialize::default
Default CGI::Session serializer
CGI::Session::Serialize::freezethaw
serializer for CGI::Session
CGI::Session::Serialize::json
serializer for CGI::Session
CGI::Session::Serialize::storable
Serializer for CGI::Session
CGI::Session::Serialize::yaml
serializer for CGI::Session
CGI::Session::Tutorial
Extended CGI::Session manual

Provides

CGI::Session::Test::Default
in lib/CGI/Session/Test/Default.pm
OverloadedObjectClass
in lib/CGI/Session/Test/Default.pm
SimpleObjectClass
in lib/CGI/Session/Test/Default.pm

Examples

Other files