php-cmd-audit

PHP command injection audit (php-cmd-audit)

Analyze PHP project source code, identify code related to system command execution, and trace user input to command construction points to verify whether a command injection risk exists.

CRITICAL

• Data flow chain evidence must be used to determine exploitability
• Omission prohibited: no ellipsis placeholders may appear; each entry must contain a complete evidence chain and an observable verification framework
• Each high-risk/medium-risk entry must include: location evidence + Source to Sink data flow chain + exploitability preconditions + executable PoC + remediation recommendations

Grading and numbering

• See shared/SEVERITY_RATING.md
• Vulnerability number:{C/H/M/L}-CMD-{序号}

Command execution sinks (required)

Identify the following functions/syntax:

• exec/system/shell_exec/passthru
• proc_open/popen/pcntl_exec
• Backtick syntax:`cmd` Dangerous patterns:
• The command string contains user input (GET/POST/Body/parameter fields) through concatenation
• No whitelist/no shell escaping, especially containing ;|&、$(), backticks, newlines, etc.

Tracing and verification (required)

Conditions for triggering php-route-tracer :

• The command string consists of multiple variables
• Parameters exist that undergo JSON decoding/multi-layer passing
• Command construction is affected by if/try branches

Report output

Output to:

{output_path}/vuln_audit/cmd_{timestamp}.md

Vulnerability entry template (mandatory)

### [{等级前缀}-CMD-{序号}] {风险标题}

| 项目 | 信息 |
|------|------|
| 严重等级 | {🔴/🟠/🟡/🔵} (CVSS {score}) |
| 可达性 (R) | {0-3} - {理由} |
| 影响范围 (I) | {0-3} - {理由} |
| 利用复杂度 (C) | {0-3} - {理由} |
| 可利用性 | ✅ 已确认 / ⚠️ 待验证 / ❌ 不可利用 / 🔍 环境依赖 |
| 位置 | {file}:{line} ({Function/Class}) |

#### 数据流链（Source → Sink）
（逐行写出：请求参数读取 -> 拼接/拼装 -> 命令执行函数/语句）

#### 可利用前置条件
- 鉴权要求：{无需/需登录/需特定权限}
- 输入可控性：{完全可控/条件可控/不可控}
- 触发条件：{分支/异常/环境依赖}

#### 证据引用（强制：来自 php-route-tracer）
每条命令注入疑似漏洞必须逐项引用 trace 输出中 `## 9) Sink Evidence Type Checklist` 的 **CMD 行**对应证据要点（允许状态为待验证，但证据引用必须存在）：
1. `EVID_CMD_EXEC_POINT`：命令执行函数/语句位置（对应 trace 的 CMD 执行点证据）
2. `EVID_CMD_COMMAND_STRING_CONSTRUCTION`：命令字符串/关键参数构造位置（拼接/模板化证据）
3. `EVID_CMD_USER_PARAM_TO_CMD_FRAGMENT`：用户可控参数到命令关键片段的映射证据

#### tracer 证据缺失处理（强制）
- 若无法定位上述 1~3 任一关键证据要点：该漏洞状态只能标记为 `⚠️待验证`，不得直接给出 `✅已确认可利用`。

#### 验证 PoC（强制）
```http
POST {完整路径} HTTP/1.1
Host: {host}
{必要 Cookie/Auth}

{Payload}

Recommended remediation

• Mandatory use of a command parameter whitelist + secure parameter concatenation strategy (avoid the shell=true case)
• Recommended alternative implementation (such as using a process invocation method that does not go through the shell, or completely avoiding concatenation)
• Provide code search statements (rg) to locate similar concatenation points