PHP allow_url_include Is Enabled

Severity: Low
Summary#

Invicti detected that the allow_url_include directive is enabled.

Impact#

When allow_url_include is enabled, PHP can include scripts from remote locations, such as HTTP or FTP servers. In practice, this feature is hardly used by any application. However, this feature can lead to serious security vulnerabilities. Namely, an attacker can use it to turn a local file inclusion vulnerability into a remote file inclusion vulnerability, either enabling or simplifying the achievement of remote code execution.

Actions To Take#

In order to disable allow_url_include, please add or modify the respective php.ini configuration option as seen below. This configuration option is available since PHP 5.2.0 and was marked as deprecated as of PHP 7.4.0.

allow_url_include = Off
Classifications#
Invicti

Dead accurate, fast & easy-to-use Web Application Security Scanner

Get a demo