PHP versions 5.3.2 and below utilize a cryptographically weak random number generator to produce session ID information. Additionally, not enough entropy is used for the initial seeding of the RNG, and some of the entropy can leak by careless use of the uniqid() PHP function. Under certain circumstances, these individual weaknesses interact and reduce the number of possible values of a PHP session ID so much that exhaustive search for a valid session ID against the web server becomes feasible.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/87769/php532-rng.txt
Source: https://packetstormsecurity.com/files/87769/PHP-5.3.2-Weak-Random-Number-Generator.html