PHP Gen 2 | Mend.io Documentation

Note:

Gen 1 is the default detection engine for existing customers. Please reach out to your Customer Success Manager at Mend.io to upgrade to Gen 2.
Gen 1 will be deprecated soon. Please visit this page for more information about the deprecation dates of the varioius Gen 1 engines.

This article covers PHP support and vulnerability detection for Mend SAST.

Mend SAST-supported PHP file types

File Type
.php
.php2 *
.php3 *
.php4 *
.php5 *
.php6 *
.phtm *

* Note: These extensions are marked as ‘Secondary’ file extensions.
They will only be scanned if at least one file with any of the other ‘Primary’ file extensions is present to identify the language as the relevant language.

Mend SAST-supported PHP frameworks

Framework
Cake PHP
CodeIgniter
Kohana
Laravel
Phalcon
Symfony
Yii
Zend

Mend SAST-supported PHP vulnerability types

The PHP vulnerability types detected by SAST are provided below, organized by CWE ID within each of their identified severities.

PHP high-severity vulnerability types

CWE	Vulnerability Type	Low Probability Impact
CWE-22	Path Traversal	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-73	File Manipulation (External Control of File Name/Path)	UNAFFECTED
CWE-78	Command Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-79	XSS	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-89	SQL Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-94	Code Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-98	File Inclusion	UNAFFECTED
CWE-384	Session Fixation	UNAFFECTED
CWE-502	Deserialization of Untrusted Data	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-639	IDOR	UNAFFECTED
CWE-643	XPath Injection	UNAFFECTED
CWE-732	Insecure File Permission	UNAFFECTED
CWE-918	Server-Side Request Forgery	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-943	NoSQL Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)

PHP medium-severity vulnerability types

CWE	Vulnerability Type	Low Probability Impact
CWE-90	LDAP Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-209	Error Message Information Exposure	UNAFFECTED
CWE-295	Improper Certificate Validation	UNAFFECTED
CWE-327	Weak Crypto	UNAFFECTED
CWE-338	Weak Random	UNAFFECTED
CWE-377	Insecure Temporary File	UNAFFECTED
CWE-400	Sleep DoS	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-472	Parameter Tampering (External Control of Assumed-Immutable Web Parameter)	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-611	XXE	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-676	Misc Dangerous Function	UNAFFECTED
CWE-798	Hard-Coded Credentials	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-1336	Template Injection	UNAFFECTED

PHP low-severity vulnerability types

CWE	Vulnerability Type	Low Probability Impact
CWE-20	Mail Relay	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-20	Memcache Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-113	HTTP Response Header Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-117	Log Injection	UNAFFECTED
CWE-326	Weak Encryption	UNAFFECTED
CWE-328	Weak Hash	UNAFFECTED
CWE-434	Unrestricted File Upload	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-530	Dangerous File Extension	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-601	Open Redirect	UNAFFECTED
CWE-941	Arbitrary Server Connection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-1004	Missing HttpOnly Flag	UNAFFECTED
CWE-1333	ReDoS	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)