Implementation of a Static Analyzer for Detecting the PHP File Inclusion Vulnerabilities 


Vol. 18,  No. 5, pp. 193-204, Oct.  2011
10.3745/KIPSTA.2011.18.5.193


PDF
  Abstract

Since web applications are accessed by anonymous users via web, more security risks are imposed on those applications. In particular, because security vulnerabilities caused by insecure source codes cannot be properly handled by the system-level security system such as the intrusion detection system, it is necessary to eliminate such problems in advance. In this paper, to enhance the security of web applications, we develop a static analyzer for detecting the well-known security vulnerability of PHP file inclusion vulnerability. Using a semantic based static analysis, our vulnerability analyzer guarantees the soundness of the vulnerability detection and imposes no runtime overhead, differently from the other approaches such as the penetration test method and the application firewall method. For this end, our analyzer adopts abstract interpretation framework and uses an abstract analysis domain designed for the detection of the target vulnerability in PHP programs. Thus, our analyzer can efficiently analyze complicated data-flow relations in PHP programs caused by extensive usage of string data. The analysis results can be browsed using a JAVA GUI tool and the memory states and variable values at vulnerable program points can also be checked. To show the correctness and practicability of our analyzer, we analyzed the source codes of open PHP applications using the analyzer. Our experimental results show that our analyzer has practical performance in analysis capability and execution time.

  Statistics
  Cite this article

[IEEE Style]

J. S. Ahn and S. C. Lim, "Implementation of a Static Analyzer for Detecting the PHP File Inclusion Vulnerabilities," The KIPS Transactions:PartA, vol. 18, no. 5, pp. 193-204, 2011. DOI: 10.3745/KIPSTA.2011.18.5.193.

[ACM Style]

Joon Seon Ahn and Seong Chae Lim. 2011. Implementation of a Static Analyzer for Detecting the PHP File Inclusion Vulnerabilities. The KIPS Transactions:PartA, 18, 5, (2011), 193-204. DOI: 10.3745/KIPSTA.2011.18.5.193.

Forms

Search
(IN TITLE, AUTHOR, ABSTRACT,KEYWORDS)

Advanced Search ▼

POPULAR KEYWORDS
(TOP 10 KEYWORDS)

Recent Publications
(LAST 3 YEARS)

Old Journals

Indexing

All publications of TKIPS is indexed in DOI, EBSCO, Google Scholar, Crossref, and CrossCheck.

TKIPS is also selected as the Journal for Accreditation by NRF (National Research Foundation of Korea).

Related Journals