Can I read VulPathsFinder: A Static Method for Finding Vulnerable Paths in PHP Applications Based on CPG on EtoBox?

VulPathsFinder: A Static Method for Finding Vulnerable Paths in PHP Applications Based on CPG by Chunhui Zhao; Tengfei Tu; Cheng Wang; Sujuan Qin is a Engineering article available to read on EtoBox.

What is VulPathsFinder: A Static Method for Finding Vulnerable Paths in PHP Applications Based on CPG about?

Today, as PHP application technology is becoming increasingly mature, the functions of modern multi-layer web applications are becoming more and more complete, and the complexity is also gradually increasing. While providing developers with various business functions and interfaces, multi-tier Web applications also successfully cover the details of application development. This type of web application adopts a unified entrance, many object-oriented codes are used, and features such as encapsulation, inheritance, and polymorphism bring challenges to vulnerability mining from the perspective of static analysis. A large amount of object-oriented code makes it impossible for a simple function name-matching method to build a complete call graph (CG), resulting in the inability to perform a comprehensive interprocedural analysis. At the same time, the encapsulation feature of the class makes the data hidden in the object attribute, and the vulnerability path cannot be obtained through the general data-flow analysis. In response to the above issues, we propose a vulnerability detection method that supports vulnerability detection for multi-layer web applications based on MVC (Model-View-C

Who reads VulPathsFinder: A Static Method for Finding Vulnerable Paths in PHP Applications Based on CPG?

Author

Chunhui Zhao; Tengfei Tu; Cheng Wang; Sujuan Qin

Publisher

MDPI AG

Published

2023

Language

EN

Field

Engineering (Physical Sciences)