PHP : Weak random number generator

Used pseudorandom number generator (PRNG) is not secure, since it generates a predictable sequence. This can be exploited to bypass authentication and capture the user’s session, as well as to carry out the DNS cache poisoning attack.

PRNGs generate chains of numbers based on the initial value referred to as seed. There are two types of PRNGs: statistical and cryptographic. Statistical PRNGs generate predictable sequences that are similar to truly random according to the statistical characteristics. They must not be used for security purposes. On the contrary, it is impossible to predict the output of a cryptographic PRNG, if the seed value is derived from a source with high entropy. Using current time as seed value is insecure due to low entropy.

PHP functions rand, srand, mt_rand, mt_srand generate predictable sequences and must not be used in information security context.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.