Description

Detects insecure file upload handling in PHP applications where dangerous upload functions are used without proper file type validation or security controls. This vulnerability could allow attackers to upload malicious files (like PHP shells) leading to remote code execution.

Detection Strategy

• Identifies file upload function calls like move_uploaded_file() or copy() in PHP code

• Checks if the file upload functions are used without proper validation of file type/extension

• Reports a vulnerability when file operations don't implement security controls like file type whitelisting or extension validation

• Examines the arguments passed to file upload functions to determine if they come from untrusted user input

Vulnerable code example

<?php
function process_upload() {
    if (!isset($_FILES['file'])) return;
    
    // SOURCE: Attacker controls both filename and content
    $unsafe_name = $_FILES['file']['name'];
    
    // SINK: Vulnerable - writing file with unsanitized user input filename...

✅ Secure code example

<?php
function process_upload() {
    if (!isset($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
        return;
    }
    
    // Validate file type using finfo
    $finfo = finfo_open(FILEINFO_MIME_TYPE);...