[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572338-105":53,"doc-detail-572338-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","security-testing-on-file-upload-web-applications-based-on-the-yii-2-framework","Security Testing On File Upload Web Applications Based - On The Yii 2 Framework","","The paper evaluates the security resilience of a Yii 2-based web file upload application using STRIDE threat modeling and DREAD risk assessment. Four representative attack vectors—SQL Injection, Cross-site Scripting, Remote Access Trojan via file upload, and Buffer Overflow—are simulated in a controlled environment referencing real-world CVEs. Results show all vectors blocked through strict MIME-type filtering, input restriction, and built-in validation. DREAD scoring indicates high risk for SQLi and Remote Attacks, while XSS and Buffer Overflow are medium.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/security-testing-on-file-upload-web-applications-based-on-the-yii-2-framework/572338/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/security-testing-on-file-upload-web-applications-based-on-the-yii-2-framework/572338.png","ImageObject",442,249,{"name":88,"@type":89},"Genevieve","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-19","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":79},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"Which frameworks are used to assess the Yii 2 file upload security in this study?","Question",{"text":108,"@type":109},"The study uses STRIDE for threat modeling and DREAD for risk assessment.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"What attack vectors are simulated against the Yii 2-based file upload application?",{"text":113,"@type":109},"It simulates SQL Injection, Cross-site Scripting, Remote Access Trojan via file upload, and Buffer Overflow.",{"name":115,"@type":106,"acceptedAnswer":116},"How do the experimental results evaluate the effectiveness of built-in protections?",{"text":117,"@type":109},"The application blocks all attack vectors through strict MIME-type filtering, input restriction, and built-in validation, with DREAD scores separating high-risk and medium-risk categories.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},572338,1792359723,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":79,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":8,"language":135,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":61,"update_tm":139,"read_time":79},1374391974585,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","Security Testing On File Upload Web Applications Based  \nOn The Yii 2 Framework  \nRico Setyawan1), Rheva Anindya Wijayanti2,*), Hermawan Setiawan3)  \n1) Mahkamah Konstitusi Republik Indonesia, [rico.setyawan@mkri.id](rico.setyawan@mkri.id)  \n2) Badan Siber dan Sandi Negara, [rhevaanindyaw@gmail.com](rhevaanindyaw@gmail.com)  \n3) Program Studi Rekayasa Kriptografi, Politeknik Siber dan Sandi Negara, [hermawan.setiawan@poltekssn.ac.id](hermawan.setiawan@poltekssn.ac.id)  \nSent: 2 Sep 2025  \nReceived: 21 May 2026  \nPublished: 22 May 2026  \nKeywords:  \nSecurity Testing File Upload Yii 2 Framework STRIDE  \nDREAD  \n\n| Abstrak |\n| --- |\n| Kerangka kerja Yii 2 banyak digunakan untuk mengembangkanaplikasi web modern karena kemampuan performa tinggi danarsitektur yang terstruktur. Namun, kerentanan nyata seperti CVE- 2018-7269 menunjukkan bahwa masalah keamanan masih dapatterjadi meskipun terdapat mekanisme bawaan. Penelitian ini mengevaluasi ketahanan keamanan aplikasi unggah berkas berbasis Yii 2 dengan menggunakan kerangka pemodelan ancaman STRIDE dan model penilaian risiko DREAD. Empat vektor serangan—SQL Injection (SQLi), Cross-site Scripting (XSS), Remote Access Trojan (RAT) melaluiunggahan berkas, dan Buffer Overflow—disimulasikandalam lingkunganterkontrol dengan mengacupada CVE dunianyata. Hasil eksperimen menunjukkan bahwa aplikasi berhasil memblokir seluruh serangan melalui validasi bawaan, pembatasan masukan, dan pemfilteran ketat tipe MIME. Penilaian DREAD mengungkapkantingkat risiko tinggi untuk SQLi (7 .6) dan RAT (7 .8), sedangkan XSS (5.6) dan Buffer Overflow (6.2) dikategorikan pada risiko sedang. Temuan ini menunjukkan bahwa aplikasi berbasis Yii 2 yang diujimemiliki mekanisme keamananyang efektif dalam kondisi pengujian, sekaligus menekankan pentingnya pengujian berkelanjutan dan penerapan SSDLC. |\n| Abstract |\n\nThe Yii 2 framework is widely used for developing modern web applications due to its high-performance capabilities and structured architecture. Nevertheless, real-world vulnerabilities, such as CVE- 2018-7269, highlight persistent security concerns despite the built-in mechanisms. This study evaluates the security resilience of a Yii 2-based file upload application using the STRIDE threat modelling framework and the DREAD risk assessment model. Four attack vectors—SQL Injection (SQLi), Cross-site Scripting (XSS), Remote Access Trojan (RAT) via file upload, and Buffer Overflow—were simulated in a controlled environment referencing real-world CVEs. Experimental results show that the application successfully blocked all vectors through strict MIME-type filtering, input restriction, and builtin validation. DREAD scoring revealed high-risk severity for SQLi (7.6) and Remote Attacks (7.8), while XSS (5.6) and Buffer Overflow (6 .2) were categorised as medium risks. These findings indicate that the tested Yii 2-based application demonstrates effective security mechanisms under the evaluated conditions, while highlighting the importance of continuous testing and SSDLC integration.  \n1. INTRODUCTION  \nThe rapid growth of information technology has transformed how organisations deliver services, particularly through web applications. These applications are widely used for communication, transactions, and the sharing of information. However, their popularity also makes them attractive targets for attackers. Common attack vectors include SQL Injection, Cross-Site Scripting (XSS), Buffer Overflow, and malicious file uploads, all of which can compromise system integrity and user trust [5] .  \nThe file upload functionality, in particular, poses significant security risks, as improperly validated files may allow for remote code execution or data breaches [1][3][4] . While numerous frameworks offer security features, their actual resilience against real-world attacks often remains untested in practice [6] .  \nNumerous studies have evaluated the security of web application frameworks and have demonstrated that frameworks can he","cbCaiqIfVZaT2pyh","https://ap.wps.com/l/cbCaiqIfVZaT2pyh","pdf",656929,"English","# Abstract\n# 1. Introduction\n# 2. Basic Concept","[{\"question\":\"Which frameworks are used to assess the Yii 2 file upload security in this study?\",\"answer\":\"The study uses STRIDE for threat modeling and DREAD for risk assessment.\"},{\"question\":\"What attack vectors are simulated against the Yii 2-based file upload application?\",\"answer\":\"It simulates SQL Injection, Cross-site Scripting, Remote Access Trojan via file upload, and Buffer Overflow.\"},{\"question\":\"How do the experimental results evaluate the effectiveness of built-in protections?\",\"answer\":\"The application blocks all attack vectors through strict MIME-type filtering, input restriction, and built-in validation, with DREAD scores separating high-risk and medium-risk categories.\"}]","Security Testing On File Upload Web Applications Based - On The Yii 2 Framework | PDF",1791926835]