Summary #

Invicti detected that the allow_url_include directive is enabled.

Impact #

When allow_url_include is enabled, PHP can include scripts from remote locations, such as HTTP or FTP servers. In practice, this feature is hardly used by any application. However, this feature can lead to serious security vulnerabilities. Namely, an attacker can use it to turn a local file inclusion vulnerability into a remote file inclusion vulnerability, either enabling or simplifying the achievement of remote code execution.

Actions To Take #

In order to disable allow_url_include, please add or modify the respective php.ini configuration option as seen below. This configuration option is available since PHP 5.2.0 and was marked as deprecated as of PHP 7.4.0.

allow_url_include = Off
Classifications #
CWE-16; OWASP 2013-A5; OWASP 2017-A6
Vulnerability Index

Vulnerability Index

You can search and find all vulnerabilities


Search Vulnerability


Dead accurate, fast & easy-to-use Web Application Security Scanner

Get a demo