eresus-php-audit

PHP Security Audit

Purpose

Perform a comprehensive, depth-first security audit of PHP codebases. This skill provides the complete knowledge of Kunlun-M's CVI rule set, organized by vulnerability class, plus framework-specific patterns for Laravel, WordPress, Symfony, and modern PHP 8.x applications.

Use view_file and grep_search exclusively. No terminal commands.

---

Audit Workflow

Phase 1: Reconnaissance

1. Identify the PHP framework/CMS (Laravel, WordPress, Symfony, CodeIgniter, raw PHP)
2. Check composer.json / composer.lock for known vulnerable dependencies
3. Map entry points: routes, controllers, REST endpoints, admin pages, AJAX handlers
4. Identify the autoloader and class loading mechanism
5. Check PHP version requirements (php constraint in composer.json)

Phase 2: Entry Point Discovery

Inspired by Kunlun-M's EntranceFinder plugin — systematically find all user-facing entry points:

1. Direct file access — find all .php files that can be accessed directly (not included/required)
2. Route definitions — check framework routing files
3. AJAX handlers — WordPress wp_ajax_*, Laravel API routes, custom handlers
4. CLI entry — Artisan commands, WP-CLI commands, custom scripts
5. Cron jobs — scheduled tasks that process external data

Search patterns for entry points:

• Files with $_GET, $_POST, $_REQUEST, $_FILES, $_COOKIE, $_SERVER
• Files with file_get_contents('php://input')
• Laravel: Route::get, Route::post, Route::any, Route::resource
• WordPress: add_action('wp_ajax_, add_action('rest_api_init
• Symfony: #[Route(, @Route(, routing.yaml definitions

---

CVI Rules — Injection

CVI-1001: SSRF

Search for HTTP request functions with user-controlled URLs:

curl_setopt($ch, CURLOPT_URL, $userInput)
file_get_contents($userUrl)
fopen($userUrl, 'r')
$client->get($userInput)  // Guzzle
$client->request('GET', $userInput)

Severity: HIGH — can lead to internal service access, cloud metadata theft Trace: Check if URL comes from $_GET, $_POST, database with user data