Zennoxa Shield
Rules / PHP
SHIELD-PHP-003

OS command injection via shell execution functions

criticalPHPCWE-78CVSS 9.8

What it detects

A variable is passed to a shell command execution function enabling arbitrary command execution.

How to fix

Avoid shell calls with user data; use escapeshellarg/escapeshellcmd or safe library APIs.

Vulnerable — Shield flags thisping.php
<?php
// Network diagnostic endpoint — vulnerable to command injection
$output = shell_exec("ping -c 1 " . $_GET['host']);
echo "<pre>" . htmlspecialchars($output, ENT_QUOTES) . "</pre>";
Fixed — scans cleanping.php
<?php
// No shell call: validate the input, then use a native socket check
$host = filter_var($_GET['host'] ?? '', FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME);
if ($host === false) {
    exit('Invalid host');
}
$up = @fsockopen($host, 443, $errno, $errstr, 2);
echo $up ? 'reachable' : 'unreachable';

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-003, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-003: OS command injection via shell execution functions — Zennoxa Shield