标题： BACFuzz：揭示Web应用程序中受损访问控制漏洞的沉默 显示英文标题

标题： BACFuzz: Exposing the Silence on Broken Access Control Vulnerabilities in Web Applications

摘要： 访问控制破坏（BAC）仍然是Web应用程序中最关键和最普遍的漏洞之一，允许攻击者访问未经授权的资源或执行特权操作。尽管其严重性，由于关键挑战：缺乏可靠的Oracle和生成语义有效的攻击请求的难度，BAC在自动化测试中研究不足。我们引入了BACFuzz，第一个专门设计用于发现BAC漏洞的灰盒模糊框架，包括基于对象级别的授权破坏（BOLA）和基于功能级别的授权破坏（BFLA）在基于PHP的Web应用程序中。BACFuzz结合LLM引导的参数选择与运行时反馈和基于SQL的Oracle检查来检测无声的授权缺陷。它使用轻量级的仪器来捕获指导测试生成的运行时信息，并分析后端SQL查询以验证未经授权的输入是否流入受保护的操作。在20个实际的Web应用程序上进行评估，包括15个CVE案例和2个已知基准，BACFuzz检测到了17个已知问题中的16个，并发现了26个之前未知的BAC漏洞，误报率较低。所有识别的问题都已负责任地披露，相关工件将公开发布。 显示英文摘要

摘要： Broken Access Control (BAC) remains one of the most critical and widespread vulnerabilities in web applications, allowing attackers to access unauthorized resources or perform privileged actions. Despite its severity, BAC is underexplored in automated testing due to key challenges: the lack of reliable oracles and the difficulty of generating semantically valid attack requests. We introduce BACFuzz, the first gray-box fuzzing framework specifically designed to uncover BAC vulnerabilities, including Broken Object-Level Authorization (BOLA) and Broken Function-Level Authorization (BFLA) in PHP-based web applications. BACFuzz combines LLM-guided parameter selection with runtime feedback and SQL-based oracle checking to detect silent authorization flaws. It employs lightweight instrumentation to capture runtime information that guides test generation, and analyzes backend SQL queries to verify whether unauthorized inputs flow into protected operations. Evaluated on 20 real-world web applications, including 15 CVE cases and 2 known benchmarks, BACFuzz detects 16 of 17 known issues and uncovers 26 previously unknown BAC vulnerabilities with low false positive rates. All identified issues have been responsibly disclosed, and artifacts will be publicly released.