Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zelon88/HRConvert2

              master @ 45abfaa
            

Fixes

CVEs

CRITICAL

Peak severity

100.0%

Coverage

Highlights

Command Injection: 6 prior fixes. Scrutinize any change in this area.

convertCore.php: most-fixed (22 issues). Treat as high-risk during review.

19 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Six separate fixes were required to sanitize user input before shell execution, with repeated additions of dangerous characters (newline, backtick, tab) indicating a persistent blacklist bypass problem. The sink is shell_exec with user-controlled pathnames, making this the most actively exploited and highest-severity class.

Path Traversal: Five fixes addressed path traversal across multiple sinks (uploadFiles, shell_exec, scandir/symlink, getExtension), showing that file paths derived from user input are a recurring weak point. The fixes are ad-hoc (rejecting '.'/'..', stripping '..'), which is fragile against encoding or symlink tricks.

Auth Bypass: Three fixes strengthened authentication by adding server-derived tokens (Token2, SesHash2) and strict IP validation. The repeated patching of session/token mechanisms suggests the original design was weak and has been iteratively hardened; residual risk remains if any older token path is still accepted.