php-file-upload-audit

PHP file upload audit (php-file-upload-audit)

Unified execution strategy (mandatory)

Must follow:shared/PHP_AUDIT_EXECUTION_POLICY.md。

During execution, uniformly adopt the "dual-channel + evidence layering" rule:

• High-recall channel: first perform static source/sink initial screening, covering HTTP routes and non-route entry points (CLI/cron/queue/include)

• High-confidence channel: then use trace/EVID for confirmation and noise reduction

Status determination is unified as:✅已确认 / 🟡高概率 / ⚠️待验证 / ❌不可利用 / 🔍环境依赖

• Meets the minimum evidence set (reachable fragment + controllable clue + sink trigger clue) => can be marked 🟡高概率

• Meets complete trace + EVID => mark ✅已确认

• Insufficient evidence => mark ⚠️待验证

Rigor requirements remain unchanged, but do not stay silent due to an incomplete trace: still output suspected high-risk and missing evidence.

Analyze PHP project source code and identify file upload logic:$_FILES、move_uploaded_file etc., trace the save directory and filename handling method, and detect:

• Arbitrary file upload (any type/any extension)

• Path traversal (using the original filename for concatenation)

• Executable file upload (uploaded to a web-accessible directory with execution unrestricted)

• Overwrite/same-name conflict risk

Unified audit standard (mandatory)

Must follow:shared/PHP_AUDIT_UNIFIED_STANDARD.md。

The status order must be fixed as:✅已确认 / 🟡高概率 / ⚠️待验证 / ❌不可利用 / 🔍环境依赖. trace evidence determination must be performed in layers:

• Meets the minimum evidence set (entry reachable + parameter controllable chain + sink execution clue + basic preconditions) => 🟡高概率
• Meets the complete evidence set (trace COMPLETE + EVID aligned + branch coverage) => ✅已确认
• Does not meet the minimum evidence set => ⚠️待验证

False-positive suppression must check: hardcoded override, whitelist effective, unreachable branches, sandbox/permission boundaries. False-negative suppression must be performed: do not stay silent when the trace is incomplete, sink-only fallback. The minimum output fields must include: location, source->sink, preconditions, status, PoC, remediation. Execution priority must follow: discover first, document later.

Evidence confidence field and review checklist (mandatory)

Evidence confidence field (mandatory): according to shared/PHP_AUDIT_UNIFIED_STANDARD.md output HIGH/MEDIUM/LOW, and provide the basis for determination (consistent with the status). Review checklist (mandatory, at least 5 items):

• Whether the high-recall channel (phase 0) has been executed or the sink-only fallback has been enabled, and non-route entry points are covered
• Whether same-category extension checks have been completed (after hitting a certain type of upload sink, horizontally scan same-category entry points/save wrappers)
• Whether 🟡high probability/✅confirmed/⚠️to be verified is given according to the minimum evidence set/complete evidence set rule, and the missing points are explained
• Whether the source->sink data flow chain is clearly linked to filename parsing/extension sanitization/destination concatenation/access reachability
• Whether explanations regarding hardcoding/whitelist/unreachable/permission boundary/format not holding have been made for false-positive suppression
• Whether an executable PoC and replaceable remediation recommendations are given (including randomization strategy/MIME validation/access surface restriction/search and locate key points)

Grading and numbering

• See details:shared/SEVERITY_RATING.md

• Vulnerability number:{C/H/M/L}-UPLOAD-{序号}

Upload entry point identification (required)

Identify:

• $_FILES['{value}'] Field

• move_uploaded_file($_FILES['{value}']['tmp_name'], $dest)

• Save path concatenation:$uploadDir.$filename、sprintf、join etc.

• Rename:uniqid/random_bytes/timestamp (if filename is still controllable, it is still high risk)

Validation logic audit (mandatory)

Must be checked point by point and evidence output:

• Extension/whitelist: whether only the suffix is validated (can be bypassed)

• Extension parsing safety: whether there is a "double extension/multi-dot extension" bypass (e.g. a.php.jpg、.pHp case bypass, trailing whitespace/Unicode separator)

• MIME/magic number: whether finfo_file/mime_content_type/file header identification is performed

• MIME/magic number consistency: whether it checks whether the "actual server-side content type" is consistent with the "extension/suffix" (avoid trusting only Content-Type）

• Filename sanitization: whether path separators and dangerous characters are removed (../、\、:, null bytes, etc.)

• Upload directory: whether it is in the Web root; whether execution permission control exists

• Post-write accessibility chain: whether there is static mapping/direct link access to the upload directory (needs to be combined with routing or webserver configuration evidence)

• Authentication: whether the upload interface is protected

tracer trigger conditions (mandatory)

• The save path or filename goes through multiple layers of wrapper functions

• The validation logic has branches, making it difficult to confirm that it applies to all upload paths

Report output

Output to:

{output_path}/vuln_audit/upload_{timestamp}.md

Vulnerability entry template (mandatory)

Must include:

• Location evidence (save/validation function location)

• Data flow chain (filename/path source -> validation -> destination path -> write)

• Evidence references (from php-route-tracer output, must be cited item by item): must correspond to and cite the evidence points in the trace's ## 9) Sink Evidence Type Checklist(UPLOAD line)

  • EVID_UPLOAD_DESTPATH: destPath (final destination directory of save)

  • EVID_UPLOAD_FILENAME_EXTENSION_PARSING_SANITIZE: file name/extension parsing & sanitization (filename/extension parsing and sanitization logic)

  • EVID_UPLOAD_ACCESSIBILITY_PROOF: accessible surface evidence (whether an accessible surface is formed after write: static direct access evidence/mapping evidence)

  • EVID_UPLOAD_EXEC_DISABLE_STRATEGY: execution disable policy evidence (server-side execution disable policy, if any)

• Exploitable preconditions (authentication/directory accessibility/bypass conditions)

• Verification PoC (including the real upload route, providing the necessary multipart request structure)

• Remediation recommendations (whitelist + magic number validation + directory isolation + randomized filename + overwrite policy + Webserver execution disable points)

Handling of missing tracer evidence (mandatory, follow the unified standard)

• If in the trace's ## 9) Sink Evidence Type Checklist(UPLOAD line) the above key evidence points are missing:
  • Minimum evidence set is satisfied(reachability + parameter controllability clues + Sink execution clues + basic preconditions): can be marked as 🟡高概率, noting in the report the missing EVID points and completion suggestions.
  • Minimum evidence set is not satisfied: can only be marked as ⚠️待验证(must not directly give ✅已确认可利用）。
  • Full evidence set is satisfied(all EVID aligned + complete trace + branch coverage): can be marked as ✅已确认可利用。