Veracode is reporting that its analytics show 86 percent of PHP-based applications contain at least one Cross-Site Scripting (XSS) vulnerability and 56 percent have at least one SQL injection (SQLi) when initially assessed by Veracode. The analysis is part of a supplement to Veracode’s “2015 State of Software Security: Focus on Application Development”, which is a report based on benchmarking analytics from its cloud-based platform.
The report also indicates that four out of five applications written in PHP, Classic ASP and ColdFusion that were assessed by Veracode failed at least one of the OWASP Top 10 (an industry-standard security benchmark).
Veracode reports that these application vulnerability trends have also been seen across a wider family of web scripting languages, as applications written in Classic ASP and ColdFusion have are twice as likely to contain these flaws compared to more modern languages such as .NET and Java.
The 2015 report captures data collected over the past 18 months from more than 200,000 automated assessments performed for Veracode’s customers across a range of industries and geographies. Other findings provided in the report include
- Design of the language matters for security: Some languages are designed to avoid certain vulnerability classes. For example, by removing the need for developers to directly allocate memory, Java and .NET eliminate almost entirely those vulnerabilities dealing with memory allocation (such as buffer overflows). Another example is the default behaviors of some ASP.NET controls, which avoid common issues related to Cross-Site Scripting.
- Operating environment of the language matters for security: Some vulnerabilities are only relevant in certain execution environments. For example, some categories of information leakage are more severe for mobile, which combines large volumes of personal data with a number of always-on networking capabilities.
- Mobile development project teams need to focus on encryption: Eighty-seven percent of Android apps and 80 percent of iOS apps contained cryptographic issues according to the report. Veracode suggests this indicates that, while mobile app developers may be aware of the need for cryptography to protect sensitive data and thus use it in their applications, few of them know how to implement it correctly.