UQuery: Static Security Analysis of PHP-Based Web Programs Using Graph Models
Year: 2024
Type: conference-paper
Abstract: This paper introduces UQuery, a novel framework designed for agile security analysis of server-side web applications. UQuery employs a dependency graph, an innovative program representation that concurrently models data and control dependencies. This graph model facilitates efficient data- and control-flow analyses by converting them into intuitive graph queries. Currently, UQuery includes two security applications: one for detecting unrestricted file upload vulnerabilities and another for identifying information leakage through exploitable race conditions. It has detected vulnerabilities in 16 applications, resulting in the discovery of 6 previously unreported CVEs.
Authors: Jin Huang, Junjie Zhang, Jialun Liu, Chuang Li, Rui Dai
Institutions: Wright State University, University of Cincinnati
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W4403937602