Description:
------------
---
From manual page: http://www.php.net/function.mt-srand
---
The PHP documentations of pseudorandom related functions is missing warning, 
that these functions should not be used for security purposes - generating 
session ids, passwords, password resets etc.

The affected functions are mt_rand(), rand(), uniqid(), shuffle(), lcg_value()

Documentation should recommend openssl_random_pseudo_bytes() for these purposes.

Weakness of these functions is pretty well documented here:

http://blog.ptsecurity.com/2012/08/not-so-random-numbers-take-two.html

And there are working exploits:

http://blog.ptsecurity.com/2012/11/workshop-random-numbers-take-two-at.html