testing compiled php

["Robin Wood" <dninja () gmail com>]

Hi
I've been asked to install a compiled php app on a server I manage and
I'm not happy with the way it has been built so I'm looking for a way
to do check through the code but, as it is compiled I can't just view
it.

Is there an easy way to decompile php? I've had a google and found a
couple of services offering to decompile individual pages but nothing
for full sites.

I'm not sure what compiler was used but this app requires the zend
optimizer to run.

Things I'm not happy about:
Needs full write access to the whole of its web root, it seems to
create files and directories all over the place.
Needs almost root mysql access, the only thing it doesn't need is
grant privileges! It created databases when you add new data into the
site.
I've found XSS on the authors site and on this app - I've reported
this to the author who after claiming to be big on security asked me
to explain XSS and still hasn't fixed the problem a few weeks later.

I've got permission to test the app but I'm not being paid for it so
I'd much rather do a code review than full test on each page, that way
I can patch anything I find or make other provisions to protect from
the problem.

Robin

-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire was recently named the worldwide market leader in Web 
application security assessment tools by both Gartner and IDC. 
Download a free trial of AppScan today and see why more customers choose 
AppScan then any other solution. Try it today!
 
https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
--------------------------------------------------------------------------