Comment by codedokode

I actually looked through PHP code responsible for parsing POST request body and it's pretty bad [1].

First, there is a huge function, that is hard to read and reason about. Second, instead of proper parsing of "Content-Type" header to extract "boundary" parameter, there is just a set of substring searches which is not correct. It doesn't mean there is a vulnerability but it means PHP can read the header in a way different from a standard-compliant implementation (such as web server, WAF etc).

[1] https://github.com/php/php-src/blob/master/main/rfc1867.c#L7...