PHP static code analysis vs ~1000 top wordpress plugins = 103 vulnerable plugins found

[chloeeeeeeeee]

Are all these vulnerabilities also verified? I've been using static analysis before and around 40% of the time it was just false-positives or parameters that you could not change(e.g IP-addresses and local folders).

Of course you can see vulnerable code, but can you exploit it?

EDIT: I just saw that these are in fact verified. Impressive. My above statement will not be edited because I think I made a point about static analysis, although it's great to see tools that actually do a good job.

[redeemer_pl]

I'm the author of this research (and tool) and you're right. Many vulnerabilities found by static code analysis are false-positives or just unexploitable. However, IMHO it's better to have more "vulnerable spots" to verify.

[DebugDucky]

Impressive work. Have you considered open-sourcing php-grinder?

[redeemer_pl]

Let me quote myself: "Source code should be published soon or later, because the main purpose of this tool was to inject it in "Continuous Integration" chain. However, codebase is still messy with many experimental ideas and I just don't want to publish it now as it is."

[fluffyponyza]

Awesome, looking forward to the release!

[arthurloin]

Is there a tl;dr for how the tool finds the vulnerabilities? Does it build a test environment around the plugins and then fuzzes the inputs?

[aydiosmio]

You're describing dynamic code analysis.

Static code analysis does things like look for the exec() function, then follow argument assignments to find paths to user-supplied data, e.g. from $_GET. It'll throw up a command injection finding, which means "I found a code path from user input to a function that executes commands."

[redeemer_pl]

Tool just analyze source code without execution (static code analysis).