this should be closed, as it is fixed since 5.5.2 with the addition of the strict sessions, right?

yasuo-san, please confirm this can be closed (and marked public).

This is closed.
Use use_strict_mode=on.

is PHP5.4 affected by this CVE-2011-4718?  I see it is fixed in 5.5.2.  but how about the php 5.4 serials, such as the latest php 5.4.36?  Thank you!

For the record, this issue can be avoided by calling session_regenerate_id() properly. e.g. Regenerate session ID upon login/when item is put in cart at first time, etc. 

With use_strict_mode=On, programmer does not have to care for adoptive session manager. When use_strict_mode=Off, programmer must care for adoptive session manager.

Does it means if we never used the method session_regenerate_id(), our product will not be affected by CVE-2011-4718

＠liutj 
Yes, you are.

If you are using tran_sid, impact is severe. If you are using only cookie, impact is moderate as typical attack needs JavaScript vulnerability. Note that your colleague may able to set cookie locally by manipulating browser's cookie database directly. It does not require JavaScript vulnerability with this method. If you are using http only cookie, risk is relatively low since JavaScript injection cannot modify session cookie. However, IE had strange cookie priority when I checked it years ago. HTTP only cookie may not help with IE.