SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsphp-framework-audit

php-framework-audit

General & other

View repository

Updated 10-16 08:08

About this skill

PHP framework-specific security audit

Framework identification decision table

Identification characteristics Framework In-depth reference
composer.json → laravel/framework Laravel references/laravel-patterns.md
composer.json → topthink/framework ThinkPHP references/thinkphp-patterns.md
Existence of wp-content/ directory or wp-config.php WordPress references/wordpress-patterns.md
composer.json → symfony/framework-bundle Symfony This article briefly covers
composer.json → yiisoft/yii2 Yii2 This article briefly covers
composer.json → codeigniter4/framework CodeIgniter This article briefly covers

Laravel core checkpoints

  1. Mass Assignment -- $fillable / $guarded whether it is correctly configured,Model::create($request->all()) or update($request->all()) whether there are unfiltered fields
  2. Blade XSS -- search {!! !!} unescaped output,@php direct echo within directives, custom Blade Directive not calling e()
  3. CSRF exceptions -- VerifyCsrfToken whether the middleware $except array contains sensitive routes, API route groups by default do not include the CSRF middleware
  4. Gate / Policy -- whether controller methods call $this->authorize() or Gate::allows(), whether Policy definitions cover all CRUD
  5. Eloquent Raw -- whereRaw / havingRaw / orderByRaw / DB::raw whether variable concatenation exists in
  6. Signed URL / Debug -- APP_DEBUG=true remnants,.env Web-accessible, Telescope / Debugbar route exposure

ThinkPHP core checkpoints

  1. Historical RCE routes -- TP5.x method() coverage,Request class __construct arbitrary method invocation
  2. Cache file writing -- cache file path predictable + content controllable → write WebShell
  3. Database where injection -- where in array conditions exp / like / between expression injection,Db::raw
  4. Session deserialization -- TP6 session serialization driver may trigger POP chains
  5. Template injection -- {php} tags, variable functions {:system()}

WordPress core checkpoints

  1. Plugin action/filter -- wp_ajax_nopriv_* hooks expose unauthenticated operations, Shortcode callback parameter injection
  2. Missing $wpdb->prepare -- directly concatenating SQL into $wpdb->query()
  3. nonce verification -- form handling / AJAX handler lacks wp_verify_nonce / check_admin_referer
  4. REST API -- register_rest_route the permission_callback whether it is __return_true or missing
  5. File upload -- plugin custom upload logic bypasses wp_handle_upload the MIME check

Symfony brief overview

  • Debug mode -- APP_DEBUG=1 leaks Profiler / Web Debug Toolbar, exposing environment variables and SQL
  • YAML deserialization -- lower versions Yaml::parse support !!php/object tags leading to object injection
  • Security Voter -- custom Voter logic flaws or ACCESS_ABSTAIN misuse leading to privilege escalation

Yii2 brief overview

  • RBAC configuration -- DbManager improper permission assignment,checkAccess missing calls leading to vertical privilege escalation
  • ActiveRecord injection -- findBySql / where condition string concatenation,orderBy unfiltered

CodeIgniter brief overview

  • Global XSS filtering -- CI3 $config['global_xss_filtering'] is deprecated, CI4 requires manual invocation of esc()
  • CSRF Token -- configuration CSRFProtection but too many routes are excluded, improper Token regeneration strategy

In-depth Reference