title: register_globals exploit session array
body: <p>I have a PHP script that executes some commands to verify that a user is logged.</p>
  
  <pre><code>if (( isset ($password) &amp;&amp; $password!="" &amp;&amp; auth($password,$hidden_password)==1) || (is_array($_SESSION) &amp;&amp; $_SESSION["logged"]==1 ) ){
      $aff=display("you're logged in);
  } else {
      $aff=display("you're not logged in");
  }
  </code></pre>
  
  <p>If register_globals is set to 1 in my <code>php.ini</code>, and want to <em>inject</em> something into the URL to get authenticated every-time, whatever the password is, what can I do? </p>
  
  <p>I already tried:</p>
  
  <ul>
  <li><code>site.com/page.php?password=pass&amp;logged=1</code></li>
  <li><code>site.com/page.php?password=pass&amp;_SESSION["logged"]=array("1")</code></li>
  <li><code>site.com/page.php?password=pass&amp;hidden_password=pass</code> ==> returns "<em>you're not logged in</em>" but the thing is that I don't want to overwrite the Hidden_Password (I need it!)</li>
  <li>I tried to play also with cookies, and other http headers, but with no results</li>
  </ul>
  
  <p>Any hints?</p>