Add a PoC to trigger this bug in PHP7 series. There are a few different since $GLOBALS['_SESSION'] and PS(http_session_vars) are set to reference types.

```
<?php

ini_set('session.serialize_handler', 'php');
session_start();
$GLOBALS['ryat'] = $GLOBALS;
$_SESSION['ryat'] = 'ryat|O:8:"stdClass":0:{}';
session_write_close();
session_start();
var_dump($_SESSION);

?>
```

I'm not sure what you are describing here. If you already can run specific code and modify session data, then where vulnerability in the fact that you can modify session data? It's the given you can by virtue of you running the code. Or you mean you can modify the session data without running special code? Then I can't see from your examples how, since your examples require to modify session data as a precondition.

give you two example in real world&apps:

```
$_SESSION = array_merge($_SESSION, $_POST);
```

```
if (isset($_GET['id']) && $_GET['result']) {
	$_SESSION[$_GET['id']] = $_GET['result'];
```

you can inject any types values not only string or array via this way. and input to deserialize is still dangerous.

BTW, you can control the key and value in during session upload progress. If the `session.upload_progress.prefix` is set to empty string, then you can control full key name.

Wait, isn't this:

$_SESSION = array_merge($_SESSION, $_POST);

already a session injection? The same with the other one. Looks like you're using session injection to achieve session injection. I don't see how this bug changes anything. Same with upload progress - if you can control full key name, isn't it a definition of session injection?

You can inject arbitrary serialized data via this bug. This means allows putting user input into unserialize(). And this also means you can inject any type data, ex object injection.

ok, I think I finally get it - it allows to inject objects where previously could be only strings. May be dangerous I guess.

Fix in https://gist.github.com/842d0420ba4f74513e436ce47fd1108b
 and 1ae2bdb9c146fdb3ca36081441aed6b517f51071 in security repo. Please verify.

The patch looks like OK.