PHP allow_url_include Is Enabled
Invicti detected that the allow_url_include directive is enabled.
When allow_url_include is enabled, PHP can include scripts from remote locations, such as HTTP or FTP servers. In practice, this feature is hardly used by any application. However, this feature can lead to serious security vulnerabilities. Namely, an attacker can use it to turn a local file inclusion vulnerability into a remote file inclusion vulnerability, either enabling or simplifying the achievement of remote code execution.
In order to disable allow_url_include, please add or modify the respective php.ini configuration option as seen below. This configuration option is available since PHP 5.2.0 and was marked as deprecated as of PHP 7.4.0.
allow_url_include = Off
Select Category
Search Vulnerability
Related Vulnerabilities
