PHP File Upload Audit (php-file-upload-audit)

Unified Execution Policy (Mandatory)

Must follow:

shared/PHP_AUDIT_EXECUTION_POLICY.md

Unifiedly adopt the "Dual Channel + Evidence Stratification" rule during execution:

High Recall Channel: First perform static
```
source/sink
```
preliminary screening, covering HTTP routes and non-route entry points (CLI/cron/queue/include)
High Confidence Channel: Then use
```
trace/EVID
```
for confirmation and noise reduction

Status determination is unified as:

✅Confirmed / 🟡High Probability / ⚠️Pending Verification / ❌Unusable / 🔍Environment Dependent

Meet the minimum evidence set (reachable fragments + controllable clues + sink trigger clues) => Can be marked as
```
🟡High Probability
```
Meet complete trace + EVID => Mark as
```
✅Confirmed
```
Insufficient evidence => Mark as
```
⚠️Pending Verification
```

The rigor requirement remains unchanged, but silence is not allowed due to incomplete trace: suspected high-risk issues and missing evidence must still be output.

Analyze PHP project source code to identify file upload logic:

$_FILES

move_uploaded_file

, etc., track save directories and filename processing methods, detect:

Arbitrary file upload (any type/any extension)
Path traversal (using original filename concatenation)
Executable file upload (uploaded to web-accessible directory without execution restrictions)
Overwrite/name conflict risk

Unified Audit Standard (Mandatory)

Must follow:

shared/PHP_AUDIT_UNIFIED_STANDARD.md

Status order must be fixed as:

✅Confirmed / 🟡High Probability / ⚠️Pending Verification / ❌Unusable / 🔍Environment Dependent

. Trace evidence determination must be executed in layers:

Meet the minimum evidence set (entry reachability + parameter controllable link + sink execution clue + basic preconditions) =>
```
🟡High Probability
```
Meet the complete evidence set (trace COMPLETE + EVID alignment + branch coverage) =>
```
✅Confirmed
```
Does not meet the minimum evidence set =>
```
⚠️Pending Verification
```

False positive suppression must check: hard-coded override, whitelist effectiveness, unreachable branches, sandbox/permission boundaries. False negative suppression must be executed: no silence for incomplete trace, sink-only fallback. Minimum output fields must include: location, source->sink, preconditions, status, PoC, repair. Execution priority must follow: first discovery, then documentation.

Evidence Confidence Fields and Review Checklist (Mandatory)

Evidence confidence fields (mandatory): Output HIGH/MEDIUM/LOW according to

shared/PHP_AUDIT_UNIFIED_STANDARD.md

, and provide judgment basis (consistent with status). Review checklist (mandatory, at least 5 items):

Whether the high recall channel (Phase 0) has been executed or sink-only fallback has been enabled, covering non-route entry points
Whether similar extension checks have been completed (scan similar entry/save encapsulation horizontally after hitting a certain type of upload sink)
Whether
```
🟡High Probability
```
/
```
✅Confirmed
```
/
```
⚠️Pending Verification
```
is given according to the minimum evidence set/complete evidence set rules, and the missing points are explained
Whether the source->sink data flow chain is clearly linked to filename parsing/extension purification/destination splicing/access reachability
Whether false positive suppression has been explained for hard-coding/whitelist/unreachable/permission boundary/invalid format
Whether executable PoC and replaceable repair suggestions are provided (including randomization strategy/MIME verification/access surface restriction/search positioning key points)

Rating and Numbering

See details:
```
shared/SEVERITY_RATING.md
```
Vulnerability ID:
```
{C/H/M/L}-UPLOAD-{serial number}
```

Upload Entry Identification (Mandatory)

Identify:

```
$_FILES['{value}']
```
field

move_uploaded_file($_FILES['{value}']['tmp_name'], $dest)

Save path concatenation:
```
$uploadDir.$filename
```
,
```
sprintf
```
,
```
join
```
, etc.
Renaming:
```
uniqid
```
/
```
random_bytes
```
/timestamp (still high-risk if filename is controllable)

Validation Logic Audit (Mandatory)

Must check item by item and output evidence:

Extension/whitelist: Whether only suffix is verified (bypassable)
Extension parsing security: Whether "double suffix/multi-point suffix" bypass exists (e.g.,
```
a.php.jpg
```
, case bypass like
```
.pHp
```
, trailing whitespace/Unicode separator)
MIME/magic number: Whether
```
finfo_file
```
/
```
mime_content_type
```
/file header identification is performed
MIME/magic number consistency: Whether to check if "server actual content type" is consistent with "extension/suffix" (avoid trusting only
```
Content-Type
```
)
Filename purification: Whether path separators and dangerous characters (
```
../
```
,
```
\
```
,
```
:
```
, null byte, etc.) are removed
Upload directory: Whether it is in the web root directory; whether there is execution permission control
Post-write accessibility chain: Whether static mapping/direct link access exists for the upload directory (needs to combine routing or webserver configuration evidence)
Authentication: Whether the upload interface is protected

Tracer Trigger Conditions (Mandatory)

Save path or filename is processed through multi-layer encapsulation functions
Validation logic has branches, making it difficult to confirm effectiveness for all upload paths

Report Output

Output to:






{output_path}/vuln_audit/upload_{timestamp}.md

Vulnerability Entry Template (Mandatory)

Must include:

Location evidence (save/validation function location)
Data flow chain (filename/path source -> validation -> target path -> writing)
Evidence references (from
```
php-route-tracer
```
output, must be referenced item by item): Must correspond to and reference the key evidence points in the
```
## 9) Sink Evidence Type Checklist
```
(UPLOAD line) of the trace:
- EVID_UPLOAD_DESTPATH
  : destPath (final save directory location)
- EVID_UPLOAD_FILENAME_EXTENSION_PARSING_SANITIZE
  : file name/extension parsing & sanitization
- EVID_UPLOAD_ACCESSIBILITY_PROOF
  : Access surface evidence (whether accessible surface is formed after writing: static direct link evidence/mapping evidence)
- EVID_UPLOAD_EXEC_DISABLE_STRATEGY
  : Execution disable strategy evidence (server execution disable strategy, if any)
Exploitation preconditions (authentication/directory accessibility/bypass conditions)
Verification PoC (including real upload route, provide necessary multipart request structure)
Repair suggestions (whitelist + magic number verification + directory isolation + randomized filename + overwrite strategy + webserver execution disable key points)

Tracer Missing Evidence Handling (Mandatory, Follow Unified Standard)

If the above key evidence points are missing in the
```
## 9) Sink Evidence Type Checklist
```
(UPLOAD line) of the trace:
- Meet minimum evidence set (reachability + parameter controllability clues + Sink execution clues + basic preconditions): Can be marked as
```
🟡High Probability
```
  , note the missing EVID points and completion suggestions in the report.
- Does not meet minimum evidence set: Can only be marked as
```
⚠️Pending Verification
```
  (cannot directly give
```
✅Confirmed Exploitable
```
  ).
- Meet complete evidence set (all EVID aligned + complete trace + branch coverage): Can be marked as
```
✅Confirmed Exploitable
```
  .

php-file-upload-audit

NPX Install

Tags

SKILL.md Content (Chinese)