php-tpl-audit

PHP template injection/SSTI audit (php-tpl-audit)

Analyze PHP project source code to identify template injection (SSTI) and dangerous expression execution risks: user-controllable content affecting template selection, rendering expression parsing, or conversion into executable code.

Grading and Numbering

• See details:shared/SEVERITY_RATING.md
• Vulnerability number:{C/H/M/L}-TPL-{序号}

TPL Sink (required)

Template-related rendering/execution points:

• Twig：
  • Environment->load($templateName) / createTemplate($name) / render($template)
  • |raw Or disabling the automatic escaping policy (evidence point required)
• Laravel Blade (Illuminate/View, common in native PHP):
  • view($templateName, $data) / View::make($templateName, $data)
  • Illuminate\View\Factory->make($template) / Rendering entry $engine->render({value})
  • When the template is controllable: Blade raw output ({!! !!}) and @php directives belong to a high-risk execution chain (evidence points must be tied to the rendering/compilation entry)
• Smarty：
  • Smarty->fetch($template) / display($template)
• Custom template engine:
  • eval()、preg_replace('/e')、create_function etc. are used in template expressions
  • call_user_func / call_user_func_array parameters come from user input (may trigger expressions)

Controllability (required)

Must output:

• How user input enters the "template name/template fragment/expression string"
• Whether a strict whitelist template name mapping exists
• Whether sandbox/expression restrictions exist

tracer trigger conditions (required)

• Template selection/expression construction spans multiple functions or passes through string concatenation

Evidence citation (mandatory: from php-route-tracer)

Each suspected template injection/SSTI vulnerability must cite item by item from the trace output ## 9) Sink Evidence Type Checklist the TPL linecorresponding evidence points (status may be pending verification, but the evidence citation must exist):

1. EVID_TPL_ENGINE_RENDER_OR_PARSE_ENTRY: Evidence of the location of the template engine rendering/expression parsing point (load/createTemplate/fetch/render or equivalent entry)
2. EVID_TPL_TEMPLATE_OR_EXPR_CONTROL: Evidence of whether the template name or expression is controllable (from the mapping of route parameters to template construction variables)
3. EVID_TPL_EXEC_CHAIN_ENTRY: Execution chain entry evidence (expression evaluation/compilation/execution: such as raw/disable escape, eval/use of call_user_func, etc.)

Handling of missing tracer evidence (mandatory)

• If any of the above key evidence points 1~3 cannot be located: the vulnerability status can only be marked as ⚠️待验证, and must not be directly given ✅已确认可利用。

Report output

Output to:

{output_path}/vuln_audit/tpl_{timestamp}.md

Entries must include: data flow chain, exploitable preconditions, executable PoC framework, remediation recommendations, and search statements.