CAPEC Definitions / CAPEC-193
CAPEC-193: PHP Remote File Inclusion
In this pattern the adversary is able to load and execute arbitrary code remotely available from the application. This is usually accomplished through an insecurely configured PHP runtime environment and an improperly sanitized include or require call, which the user can then control to point to any web-accessible file. This allows adversaries to hijack the targeted application and force it to execute their own instructions.
Extended Description
No Extended Description.
Mitigations
Implementation: Perform input validation for all remote content, including remote and user-generated content
Implementation: Only allow known files to be included (allowlist)
Implementation: Make use of indirect references passed in URL parameters instead of file names
Configuration: Ensure that remote scripts cannot be include in the include or require PHP directives
Relationships with other CAPECs
CAPEC-253: Remote Code Inclusion
Prerequisites
Target application server must allow remote files to be included in the require, include, etc. PHP directives
The adversary must have the ability to make HTTP requests to the target web application.
