232
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1019 Validate Inputs 2433
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
CWE Version 4.14
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP
Remote File Inclusion')
CWE-98: Improper Control of Filename for Include/Require
Statement in PHP Program ('PHP Remote File Inclusion') 236
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Execute Unauthorized Code or Commands
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Relationship
This can be resultant from XSS/HTML injection because the same special characters can be
involved. However, this is server-side code execution, not client-side.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Server-Side Includes (SSI) Injection
WASC 36 SSI Injection
Related Attack Patterns
CAPEC-ID Attack Pattern Name
35 Leverage Executable Code in Non-Executable Files
101 Server Side Include (SSI) Injection
CWE-98: Improper Control of Filename for Include/Require Statement in PHP
Program ('PHP Remote File Inclusion')
Weakness ID : 98
Structure : Simple
Abstraction : Variant
Description
The PHP application receives input from an upstream component, but it does not restrict or
incorrectly restricts the input before its usage in "require," "include," or similar functions.
Extended Description
In certain versions and configurations of PHP, this can allow an attacker to specify a URL to
a remote location from which the product will obtain the code to execute. In other cases in
association with path traversal, the attacker can specify a local file that may contain executable
statements that can be parsed by PHP.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP
Remote File Inclusion')
CWE-98: Improper Control of Filename for Include/Require
Statement in PHP Program ('PHP Remote File Inclusion')