php-logic-audit

Original：🇨🇳 Chinese

Translated

PHP Web Business Logic Vulnerability Audit Tool. Identifies logic defects other than authentication/authorization: Mass Assignment, process bypass, race condition, state machine defects, payment/permission timing vulnerabilities, etc., and outputs evidence chains, severity ratings, PoCs and remediation suggestions (no omission allowed).

7installs

Source0xshe/php-code-audit-skill

Added on2026-08-31

NPX Install

npx skill4agent add 0xshe/php-code-audit-skill php-logic-audit

SKILL.md Content (Chinese)

View Translation Comparison →

PHP Business Logic Vulnerability Audit (php-logic-audit)

Analyzes defects related to "business process correctness" in PHP projects. Key coverage includes:

Mass Assignment (overprivileged fields can be written due to batch assignment)
Process Bypass (missing preconditions or skippable validations)
State Machine Defects (incomplete/rollbackable/inconsistent state updates)
Race Conditions (TOCTOU, multiple distributions or repeated deductions caused by concurrency, etc.)
Missing Business-layer Validation for Privilege Escalation (linked with IDOR, but focuses on business ownership consistency)
Payment/Refund/Asynchronous Task Sequencing Vulnerabilities (asynchronous callbacks can be forged or repeatedly processed)

Severity Rating and Vulnerability ID

See details:
```
shared/SEVERITY_RATING.md
```
Vulnerability ID format:
```
{C/H/M/L}-LOGIC-{serial number}
```

Mandatory Evidence Collection

Each logic vulnerability must provide:

Trigger Route and Method (real route/HTTP method)
Preconditions (conditions attackers need to meet: login status/role/resource status)
Defect Location (business service/controller/callback handler/queue consumption logic)
State Change Chain (from input -> validation -> database write/external service call -> state update)
Concurrency/Timing-related Evidence (if applicable: transaction boundaries/locks/unique constraints/idempotency handling)

Mass Assignment Audit (Mandatory)

Must detect:

Whether there are behaviors directly writing
```
$_POST/Request->all()/request()->all()
```
to models or databases
Whether there is a missing whitelist that allows updating sensitive fields (e.g.,
```
role/is_admin/status/price/owner_id
```
)
Whether ORM/framework fill protection is enabled (e.g., Laravel
```
$fillable/$guarded
```
)

Race Condition and Idempotency Audit (Mandatory)

Must detect:

Whether the same operation can be executed multiple times under concurrency (deduction, delivery, upgrade, redemption)
Whether it relies on "check-then-write" (TOCTOU) without transactions/row locks
Whether there are idempotency keys and deduplication mechanisms (e.g., payment_id/nonce)

Process Bypass Audit (Mandatory)

Must detect:

Whether validation is only performed on the front-end page but missing on the back-end
Whether process restrictions rely on front-end hidden fields/buttons
Whether callback interfaces have reliable authentication and signatures, and whether they can be repeatedly called

Type Comparison Bypass and Weak Type Vulnerabilities (Mandatory)

Weak type/loose comparison in PHP often leads to authentication/authorization/business judgment bypasses, so the following must be audited:

Whether
```
==
```
/
```
!=
```
(non-strict comparison) is used for authentication judgment, state judgment or permission validation
Whether
```
in_array($x, $arr)
```
is used without strict mode (third parameter), leading to type conversion bypass
Whether results of
```
array_search
```
,
```
strpos
```
etc. are improperly handled when participating in condition judgments (e.g.,
```
strpos
```
returning 0 is treated as false, or mixed with strings/numbers)
Whether
```
md5/sha1
```
is used for "authentication validation" and digests are directly compared with
```
==
```
(must identify whether
```
hash_equals
```
is used)
Whether token/JWT/verification code comparison logic uses methods that can be bypassed via timing inference or type juggling (comparison functions/conditional expressions need to be evidenced)

Each weak type vulnerability must provide:

Location Evidence (comparison expression/conditional statement/relevant function call location)
Source (how user input enters the comparison)
Sink (branch result caused by incorrect comparison: pass/bypass/error state)
PoC (request sequence or payload, including at least "how to construct the comparison value to trigger bypass")

Authentication/Account Workflow Logic (Mandatory)

Must audit business process security related to "state migration":

Whether password reset tokens are single-use, have clear expiration times, and are bound to users
Whether OTP/verification codes can be replayed (whether the same token/nonce can be reused)
Whether login failure count/account lockout/rate limiting are implemented on the back-end
Account Enumeration: whether error messages/response codes/latency differences leak the existence of users
Whether payment/refund callbacks are idempotent (whether the same transaction can be repeatedly recorded/disbursed)

PoCs must provide at least a two-step request sequence: first establish preconditions, then trigger state migration actions, and mark observation points (database fields/response codes/redirects/callback execution counts).

PoC (Mandatory)

PoCs for logic vulnerabilities must provide a "request sequence":

At least two steps: trigger preconditions -> trigger vulnerability action (mark real routes)
For race condition vulnerabilities: provide concurrent request methods and observation points (e.g., steps for sending two curl requests simultaneously)

Report Output

{output_path}/vuln_audit/logic_{timestamp}.md

Entry Template (Mandatory)

Location Evidence
Defect Description (must be based on code semantics, general statements are not allowed)
State Change Chain
Exploitable Preconditions
Request Sequence PoC
Remediation Suggestions (including: whitelist/transaction/lock/idempotency/back-end revalidation)

php-logic-audit

NPX Install

Tags

SKILL.md Content (Chinese)

PHP Business Logic Vulnerability Audit (php-logic-audit)

Severity Rating and Vulnerability ID

Mandatory Evidence Collection

Mass Assignment Audit (Mandatory)

Race Condition and Idempotency Audit (Mandatory)

Process Bypass Audit (Mandatory)

Type Comparison Bypass and Weak Type Vulnerabilities (Mandatory)

Authentication/Account Workflow Logic (Mandatory)

PoC (Mandatory)

Report Output

Entry Template (Mandatory)