php-injection-audit

PHP injection vulnerability source code audit

This skill focuses on determining at the source code level whether "an injection holds", with the core being to verify whether the filtering along the Source→Sink path is sufficient. Runtime exploitation techniques such as constructing payloads and bypassing WAFs fall under the scope of the corresponding black-box exploit skill.

In-depth reference

• Dangerous pattern / safe pattern code comparison / EVID evidence examples for 6 types of injection → references/injection-patterns.md

---

6 types of injection quick reference table

Type	Typical Sink	Dangerous pattern	Severity
SQL injection	PDO::query, mysqli_query, DB::raw, whereRaw	String concatenation into SQL	Critical-High
Command injection	exec, system, shell_exec, passthru, proc_open, backticks	User input concatenated into command string	Critical
SSRF	curl_exec, file_get_contents, SoapClient	User-controllable URL initiates server-side request	High-Medium
Expression injection	eval, assert, preg_replace(/e), create_function	User input enters code execution context	Critical
NoSQL injection	MongoDB find(), $where, operator $ne/$gt/$regex	Array/object parameters bypass equality comparison	High
LDAP injection	ldap_search, ldap_list, ldap_bind	User input concatenated into filter string	High-Medium

General audit process (4 steps)

Step 1 -- Confirm EVID evidence points: From php-audit-pipeline the EVID_* evidence produced in Phase 3, filter entries belonging to the injection category (EVID_SQL_、EVID_CMD_、EVID_SSRF_、EVID_EXPR_, EVID_LDAP_*). Sinks without EVID evidence can only be marked "to be verified".

Step 2 -- Determine filtering effectiveness: Trace each filtering/escaping operation along the Source→Sink path, and assess whether it is effective for the current injection type. Common pitfalls: addslashes is ineffective against GBK wide bytes,intval is ineffective against array parameters,escapeshellarg can be bypassed under specific locales.

Step 3 -- Assess bypass possibility: When filtering exists but is insufficient, analyze the specific bypass path (encoding differences, type confusion, secondary processing, etc.). If a bypass approach can be given, mark it "confirmed"; otherwise mark it "to be verified" and record the known filtering method.

Step 4 -- Determine severity: Use php-audit-pipeline 's three-dimensional scoring formula Score = R*0.40 + I*0.35 + C*0.25. The Impact of injection vulnerabilities is usually high (command/expression injection I=3, SQL injection I=2-3), but it needs to be judged comprehensively in combination with reachability and exploitation complexity.

SQL injection audit key points

• PDO prepared statements: Confirm that prepare() + execute() 's placeholder binding is complete.PDO::query($sql) and PDO::exec($sql) are direct execution, and concatenation is dangerous
• ORM pitfalls: whereRaw/havingRaw/orderByRaw/selectRaw variable concatenation is not protected by ORM parameterization
• Dynamic ORDER BY / LIMIT: These two clauses cannot use parameterized binding,intval() or a whitelist is the only safe solution
• sprintf %s concatenation: sprintf("SELECT * FROM t WHERE id='%s'", $input) is still essentially concatenation
• Second-order injection: Data is escaped when stored in the database, is not escaped when retrieved and then concatenated into a new query; tracing needs to cross storage boundaries

Command injection audit key points

• escapeshellarg effectiveness: Used alone it is usually effective, but with escapeshellcmd Using both together actually introduces a bypass (quote pairing is broken)
• Multi-parameter concatenation: exec("convert " . escapeshellarg($src) . " " . $dest) — if $dest is not escaped, injection is still possible
• Backticks: An easily overlooked command execution method; globally search for variable references inside backticks
• proc_open array mode: proc_open([$cmd, $arg1, $arg2], ...) avoids shell parsing and is a safe way to execute commands

SSRF Audit Key Points

• Protocol restrictions: Check whether protocols other than http/https are restricted (gopher:// can reach internal services,file:// can read local files)
• IP blacklist bypass: Decimal 2130706433, octal 0177.0.0.1、IPv6 [::1], and DNS Rebinding can all bypass simple IP checks
• Redirect following: curl does not follow by default, but when CURLOPT_FOLLOWLOCATION=true , the URL whitelist can be bypassed via a 302 redirect
• DNS resolution timing: The pattern of resolving and checking first and then making the request has a TOCTOU race (the exploitation point for DNS Rebinding)

Expression Injection Audit Key Points

• eval/assert: Any user-controllable data entering eval() is Critical.assert() can execute strings in PHP < 8.0
• preg_replace /e: Removed in PHP 7.0, but may still exist in legacy systems. The alternative preg_replace_callback is safe
• create_function: Essentially eval, removed in PHP 8.0 but common in old projects
• Controllable callbacks: array_map/usort/call_user_func If the callback parameters are user-controllable, it is equivalent to code execution

NoSQL / LDAP Audit Key Points (Brief)

• MongoDB operator injection: PHP array parameter $_GET['user'][$ne]=1 can bypass equality matching; check whether the input is type-cast
• $where injection: MongoDB's $where accepts JavaScript expressions; when user-controllable, it is equivalent to code execution
• LDAP filter concatenation: (&(uid=$input)(pass=$pass)) injecting *)(uid=*))(|(uid=* can modify the query logic
• Missing ldap_escape: PHP 5.6+ provides ldap_escape() but many projects do not use it; check whether (, ), *, \, NUL is escaped

Detection Checklist

• All injection-type EVID_* evidence points have been reviewed one by one
• All SQL concatenation points have been verified for whether parameterization/prepared statements are used
• All variable concatenation in ORM Raw methods has been marked
• Every parameter segment of command execution functions has been checked for escaping
• The URL source and protocol restrictions of SSRF sinks have been confirmed
• The controllability of parameters to eval/assert/preg_replace /e has been traced
• The type casting of NoSQL query parameters has been checked
• The escaping handling of LDAP filters has been confirmed
• Points with insufficient filtering have been given specific bypass ideas or marked "to be verified"
• The severity scoring uses a unified formula, consistent with the pipeline