The application uses a protection mechanism that relies on the existence or values of a cookie. In this case, there is no guarantee that the cookies belong to the current user or that they have not been modified.

Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Attackers can bypass protection mechanisms such as authorization and authentication by modifying the cookie to contain an expected value.

References

LOW

PHP : Cookie: reliance without validation

Classification

Overview

References

DerScanner Severity Score

Do you want to fix PHP : Cookie: reliance without validation in your application?

See also

PHP : Null salt

PHP : Empty password

PHP : Empty salt