Remote File Inclusion (RFI)

Description

During the scan, Kayran managed to find that an external, malicious files could be loaded.
That, might lead to Remote File Inclusion (RFI) attacks. The purpose of an RFI attack is stealing information from affected servers and taking over the site that allows content to be changed.

The attacker’s main purpose is to exploit the vulnerable mechanism found in the web application. He abuses it to upload malicious files from a remote URL located in another origin. (for example : backdoor shells)

This is an example of a PHP code that holds an RFI vulnerability. The following source code display what is occurring “behind the scenes” when a programmer writing a code holding RFI vulnerability :

<?php$page = $_POST['page'];

include($page);

?>

Recommendation

To prevent this vulnerability from occurring in the future, the user input must be verified and filtered correctly. Additionally, if the server is on Apache, make sure that allow_url_include is off so that it will not be possible to load content from any external URLs.

References

https://www.imperva.com/learn/application-security/rfi-remote-file-inclusion/

< Return to all Vulnerabilities

The Cloud

I’m pretty sure there isn’t a single adult in the world who hasn’t at least heard of The Cloud. Explaining “The Cloud” in 2022 may

Read More »

Browser Exploitation

We know that it’s possible to exploit weaknesses (or vulnerabilities) that exist in anything, from a certain code to the entire application, let’s talk about

Read More »

SQLI to RCE

How to preform SQLI TO RCE? One of the most interesting and important things about any site is the database. So, it’s important to protect

Read More »

Red Team

You’ve probably heard that there are teams in the Cyber field called Red Team and Blue Team. Let’s talk about the red one, shall we?

Read More »