Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
	public static function image($file){
		$info = '';
		$data = GetImageSize($file, $info);
		$img  = false;
		//var_dump($data,$file,memory_get_usage()-$GLOBALS['config']['appMemoryStart']);
		switch ($data[2]) {
			case IMAGETYPE_GIF:
				if (!function_exists('imagecreatefromgif')) {
					break;
				} 
				$img = imagecreatefromgif($file);
				break;
			case IMAGETYPE_JPEG:
				if (!function_exists('imagecreatefromjpeg')) {
					break;
				}
				$img = imagecreatefromjpeg($file);
				break;
			case IMAGETYPE_PNG:
				if (!function_exists('imagecreatefrompng')) {
					break;
				}
				$img = @imagecreatefrompng($file);
				imagesavealpha($img,true);
				break;
			case IMAGETYPE_XBM:
				$img = imagecreatefromxbm($file);
				break;
			case IMAGETYPE_WBMP:
				$img = imagecreatefromwbmp($file);
				break;
			case IMAGETYPE_BMP:
				$img = imagecreatefrombmp($file);
				break;
			default:break;
		}
		return $img;
	}