Remote File Inclusion (RFI)

Description

During the scan, Kayran managed to find that an external, malicious files could be loaded.
That, might lead to Remote File Inclusion (RFI) attacks. The purpose of an RFI attack is stealing information from affected servers and taking over the site that allows content to be changed.

The attacker’s main purpose is to exploit the vulnerable mechanism found in the web application. He abuses it to upload malicious files from a remote URL located in another origin. (for example : backdoor shells)

This is an example of a PHP code that holds an RFI vulnerability. The following source code display what is occurring “behind the scenes” when a programmer writing a code holding RFI vulnerability :

<?php$page = $_POST['page'];

include($page);

?>

Recommendation

To prevent this vulnerability from occurring in the future, the user input must be verified and filtered correctly. Additionally, if the server is on Apache, make sure that allow_url_include is off so that it will not be possible to load content from any external URLs.

References

https://www.imperva.com/learn/application-security/rfi-remote-file-inclusion/

< Return to all Vulnerabilities

What is Kayran

Kayran scanner is helping all businesses, both SMBs and enterprises, to test their online assets and products for over 30,000+ vulnerabilities.Kayran’s mission is to make

Read More »

Active Directory Hacking

What does Active Directory mean? The Active Directory infrastructure is a critical infrastructure in most organizations, and it forms the backbone of the organization’s computing

Read More »