A New Static Vulnerabilities Analysis Algorithm for PHP Codes - Yan, Xue-Xiong; Ma, Heng-Tai (2017 International Conference on Network and Information Systems for Computers (ICNISC), 2017)
as for detecting taint-style vulnerabilities in PHP codes, this paper introduces function calling control vulnerability, which is a new kind of taint-style vulnerabilities in PHP codes without sensitive function, and enriches classical update rules for taint analysis with a new transfer function definition, which is used to deal with statements with a single function call. The new static vulnerabilities analysis algorithm is implemented in a tool named POSE, and the experiment results of the POSE show that the new algorithm is valid for detecting more type of taint-style vulnerabilities in PHP codes.