Curated rule: detect a reachable PHP application via index.php

Adds a read only rule that flags a site as a live PHP runtime to track for
patching.  It requests index.php and reports only when that returns a real
page that differs from the control (a path that cannot exist), so a site that
answers the same catch all page for everything does not trip it, and a site
that answers not found for index.php is not called PHP.

This is an informational inventory and reachability signal.  It does not
identify the PHP build and does not confirm any CVE; confirming a memory
safety CVE would need the actual serving build, which a safe request cannot
establish.

Author: hackrange

app/core/dast_checks/curated/misconfiguration-php-index-reachable.json

@@ -0,0 +1,32 @@
+{
+  "id": "misconfiguration-php-index-reachable",
+  "class": "misconfiguration",
+  "safety": "read",
+  "severity_floor": "info",
+  "title": "PHP application is reachable (index.php is served)",
+  "summary": "GET /index.php returns a real page rather than the not found page, so a PHP front controller is served here.  This marks the site as a PHP runtime to track for patching.  It does not identify the PHP build or confirm any CVE.",
+  "needs": [],
+  "probe": [
+    {
+      "request": {
+        "method": "GET",
+        "path": "/index.php"
+      }
+    }
+  ],
+  "confirm": {
+    "control": "A path that cannot exist, so the site's not found answer is known.",
+    "differential": "status==200 and body_differs(control)",
+    "retest": 2
+  },
+  "reproduce": "curl -s -o /dev/null -w '%{http_code}\\n' https://host/index.php  (200 means a PHP front controller is served here; a 404 means it is not)",
+  "remediate": "This is an inventory signal, not a vulnerability.  If this PHP application is internet facing, make sure its PHP runtime is on a vendor patched release and the host is tracked in your patch inventory.",
+  "references": [],
+  "mappings": {
+    "cwe": "CWE-200",
+    "owasp": "A05:2021"
+  },
+  "rulesets": [
+    "php"
+  ]
+}