Edit report at https://bugs.php.net/bug.php?id=79476&edit=1
ID: 79476
Comment by: ragafa5955 at glalen dot com
Reported by: c0d1M4x at outlook dot com
Summary: remote file include
Status: Verified
Type: Documentation Problem
Package: *Configuration Issues
Operating System: Linux/Windows
PHP Version: 7.2.29
Block user comment: N
Private report: N
New Comment:
test
Previous Comments:
------------------------------------------------------------------------
[2020-04-15 09:01:37] cmb@php.net
allow_url_include defaults to Off, and is deprecated as of PHP
7.4.0. If you enable this setting, you are supposed to know what
you are doing, so this is not a security issue.
I think, though, that this can be documented better. The security
warning on the include man page[1] isn't as clear is it could be,
and likely a cautionary note should be added to the documentation
of the INI setting[2]. Furthermore, its deprecation has to be
documented.
[1] <https://www.php.net/manual/en/function.include.php>
[2] <https://www.php.net/manual/en/filesystem.configuration.php#ini.allow-url-include>
------------------------------------------------------------------------
[2020-04-14 15:28:16] c0d1M4x at outlook dot com
Description:
------------
[php version]
Test version is php 7.2.27(Centos) and php 7.3.x(Windows)
[linux install command]
yum install php72w-common php72w-fpm php72w-opcache php72w-gd php72w-mysqlnd php72w-mbstring
php72w-pecl-redis php72w-pecl-memcached php72w-devel -y
[Issus]
The issus config file is "php.ini".
When "allow_url_include" is set to "On", "auto_prepend_file" and
"auto_append_file" can be set to a remote address and can be successfully included and
exploited. This may cause the attacker to use this configuration item to use getshell for a long
time in the case of a getshell or other vulnerabilities.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=79476&edit=1