PHP 5.2.3 - EXT/Session HTTP Response Header Injection

source: https://www.securityfocus.com/bid/24268/info

PHP is prone to an HTTP-response-header-injection vulnerability because it fails to sanitize user-supplied input.

An attacker can exploit this issue to inject additional cookie attributes into session cookies. This may lead to other attacks.

This issue affects PHP 5.2.3 (and prior versions) and PHP 4.4.7 (and prior versions). 

http://www.example.com/session.php/PHPSESSID=ID;INJECTED=ATTRIBUTE;/