allow_url_include Enabled

Description

This vulnerability was detected using the information from phpinfo() page.
When the “allow_url_include” option is enabled, it is possible to retrieve data from remote places such as servers for uploading files (FTP) or websites using functions like “fopen”.
If a user’s input is not being validated properly, we may be exposed to “remote file inclusion vulnerabilities”.

This may have several different consequences, depending on the included functionality, some examples are :

  • Injection of malicious malware.
  • Information exposure by granting excessive privileges or permissions to the untrusted sources or functions.
  • Stealing user’s saved session data (Cookies).

Recommendation

Disable “allow_url_include” from :

  • For php.ini : allow_url_include = ‘off’
  • For .htaccess : php_flag allow_url_include off.

References

https://www.php.net/manual/en/filesystem.configuration.php

< Return to all Vulnerabilities

Crossing Scripts – XSS

Injections. SQL Injections. Cross-site Scripting (hence the amazing title “Crossing Scripts – XSS”). There all sorts of Injection-Based attacks, if you want to read about

Read More »

Blue Team

We’ve talked about The Red Team before, but what about The Blue Team? How is this group different from the red one? Why would we

Read More »