Vulnerable PHP detection script

<#
.SYNOPSIS
    Detects PHP installation paths, version signatures, EOL status, environment variables, and IIS configuration.
#>

Write-Host "=================================================" -ForegroundColor Cyan
Write-Host "       PHP Vulnerability & Status Inspector      " -ForegroundColor Cyan
Write-Host "=================================================" -ForegroundColor Cyan


# 1. Check PHP via PATH
Write-Host "`n[1] Checking system PATH for PHP..." -ForegroundColor Yellow
$phpCommand = Get-Command php -ErrorAction SilentlyContinue


if ($phpCommand) {
    Write-Host "  [+] PHP found in system PATH: " -NoNewline
    Write-Host "$($phpCommand.Source)" -ForegroundColor Green
    $phpPath = $phpCommand.Source
} else {
    Write-Host "  [-] PHP executable 'php.exe' not found in the system PATH." -ForegroundColor DarkYellow
    $phpPath = $null
}


# 2. Check Common Installation Directories if not found in PATH
if (-not $phpPath) {
    Write-Host "`n[2] Scanning common directories for PHP..." -ForegroundColor Yellow
    $commonDirs = @(
        "C:\php",
        "C:\Program Files\PHP",
        "C:\Program Files (x86)\PHP",
        "C:\inetpub\wwwroot\php",
        "C:\xampp\php",
        "C:\wamp64\bin\php"
    )


    foreach ($dir in $commonDirs) {
        $testPath = Join-Path $dir "php.exe"
        if (Test-Path $testPath) {
            Write-Host "  [+] Found PHP at: " -NoNewline
            Write-Host "$testPath" -ForegroundColor Green
            $phpPath =$testPath
            break
        }
    }
}


if (-not $phpPath) {
    Write-Host "`n[-] PHP could not be located on this server." -ForegroundColor Red
    exit
}


# 3. Retrieve Version and Evaluate Vulnerability Signatures
Write-Host "`n[3] Analyzing PHP Version Signatures..." -ForegroundColor Yellow
if ($phpPath) {
    try {
        $versionOutput = &$phpPath -v 2>&1
        $versionLine =$versionOutput | Select-Object -First 1
        Write-Host "  Raw Version String: $versionLine" -ForegroundColor DarkGray


        if ($versionLine -match 'PHP\s+([0-9]+\.[0-9]+\.[0-9]+)') {
            $parsedVersion = [version]$Matches[1]
            Write-Host "  Parsed Version:   $parsedVersion" -ForegroundColor Cyan


            $isVulnerable = $false; $vulnReason = ""


            if ($parsedVersion.Major -lt 8 -or ($parsedVersion.Major -eq 8 -and $parsedVersion.Minor -le 1)) {$isVulnerable = $true; $vulnReason = "End-of-Life (EOL) version. No official security patches available for critical vulnerabilities."
            }
            elseif ($parsedVersion.Major -eq 8 -and $parsedVersion.Minor -eq 2 -and$parsedVersion -lt [version]"8.2.35") {
                $isVulnerable = $true; $vulnReason = "Vulnerable to critical memory-safety RCE flaws (e.g., CVE-2026-109618 / CVE-2026-109619). Requires >= 8.2.35."
            }
            elseif ($parsedVersion.Major -eq 8 -and $parsedVersion.Minor -eq 3 -and$parsedVersion -lt [version]"8.3.36") {
                $isVulnerable = $true; $vulnReason = "Vulnerable to critical memory-safety RCE flaws (e.g., CVE-2026-109618 / CVE-2026-109619). Requires >= 8.3.36."
            }
            elseif ($parsedVersion.Major -eq 8 -and $parsedVersion.Minor -eq 4 -and$parsedVersion -lt [version]"8.4.27") {
                $isVulnerable = $true; $vulnReason = "Vulnerable to critical memory-safety RCE flaws (e.g., CVE-2026-109618 / CVE-2026-109619). Requires >= 8.4.27."
            }
            elseif ($parsedVersion.Major -eq 8 -and $parsedVersion.Minor -eq 5 -and$parsedVersion -lt [version]"8.5.12") {
                $isVulnerable = $true; $vulnReason = "Vulnerable to critical memory-safety RCE flaws (e.g., CVE-2026-109618 / CVE-2026-109619). Requires >= 8.5.12."
            }


            Write-Host "`n  [Security Audit Result]" -ForegroundColor Yellow
            if ($isVulnerable) {
                Write-Host "  [!] STATUS: VULNERABLE / UNSAFE" -ForegroundColor Red
                Write-Host "      Reason: $vulnReason" -ForegroundColor Red
            } else {
                Write-Host "  [+] STATUS: SECURE (Meets current security patch baselines)" -ForegroundColor Green
            }


        } else {
            Write-Host "  [!] Could not reliably parse version number from binary output." -ForegroundColor Yellow
        }


    } catch {
        Write-Host "  [!] Error executing PHP binary: $_" -ForegroundColor Red
    }
}


# 4. Check Environment Variables (PATH)
Write-Host "`n[4] Inspecting Environment Variables..." -ForegroundColor Yellow
$machinePath = [Environment]::GetEnvironmentVariable("Path", "Machine")
$userPath = [Environment]::GetEnvironmentVariable("Path", "User")


Write-Host "  - Checking Machine PATH..." -NoNewline
if ($phpPath -and $machinePath -like "*$(Split-Path $phpPath)*") {
    Write-Host " [Found in Machine PATH]" -ForegroundColor Green
} else {
    Write-Host " [Not in Machine PATH]" -ForegroundColor DarkYellow
}


Write-Host "  - Checking User PATH..." -NoNewline
if ($phpPath -and $userPath -like "*$(Split-Path $phpPath)*") {
    Write-Host " [Found in User PATH]" -ForegroundColor Green
} else {
    Write-Host " [Not in User PATH]" -ForegroundColor DarkYellow
}


# 5. Check IIS FastCGI Integration
Write-Host "`n[5] Checking IIS Integration..." -ForegroundColor Yellow
$iisInstalled = Get-WindowsFeature -Name Web-Server -ErrorAction SilentlyContinue
if ($iisInstalled -and $iisInstalled.Installed) {
    Write-Host "  [+] IIS is installed on this server." -ForegroundColor Cyan
    
    if (Get-Module -ListAvailable -Name WebAdministration) {
        Import-Module WebAdministration
        try {
            $fastCgiHandlers = Get-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/fastCgi/application" -name "."
            $phpFastCgi = $fastCgiHandlers | Where-Object { $_.fullPath -like "*php-cgi.exe*" }
            
            if ($phpFastCgi) {
                Write-Host "  [+] PHP is registered in IIS FastCGI:" -ForegroundColor Green
                foreach ($handler in $phpFastCgi) {
                    Write-Host "      Path: $($handler.fullPath)" -ForegroundColor Gray
                }
            } else {
                Write-Host "  [-] PHP is NOT registered in IIS FastCGI handlers." -ForegroundColor DarkYellow
            }
        } catch {
            Write-Host "  [!] Could not query IIS configuration: $_" -ForegroundColor Yellow
        }
    } else {
        Write-Host "  [!] WebAdministration module not available." -ForegroundColor Yellow
    }
} else {
    Write-Host "  [-] IIS is not installed on this server." -ForegroundColor DarkGray
}


Write-Host "`n=================================================" -ForegroundColor Cyan
Write-Host "          Scan Completed Successfully            " -ForegroundColor Cyan
Write-Host "=================================================" -ForegroundColor Cyan