PHP vulnerability detection based on taint analysis

To detect the vulnerabilities of Web applications which based on the PHP scripting language. This paper proposes a PHP vulnerability detection method based on fine-grained taint analysis algorithm. First of all, this article generates the Abstract Syntax Tree by lexical and grammatical analysis on the PHP, and then produces the corresponding Control Flow Graph. At last, performing taint analysis on the Control Flow Graph. By tracking the program parameters, variables and other external input, marking the input type, propagating to various types of vulnerability function via the taint, and finally according to the tainted types of variable which are outputted to identify the vulnerabilities. We tested 16 programs of Damm Vulnerable Web App and found nine known vulnerabilities.