Include vulnerability
From Wikipedia, the free encyclopedia
A server side include vulnerability is a vulnerability that can potentially allow an attacker to execute arbitrary scripts on a host server by including the file in an existing script. This can be caused by allowing unchecked user data in include directives in scripting languages, such as PHP.
[edit] A PHP Example
In PHP, the include() function will allow the application developer to include an external PHP script in the running script. However, if it is possible for an outsider to pass in arguments to the include function, it may be possible for a malicious user to pass in a web URL instead of a file name, allowing a (potentially) malicious script to be included and executed on the host server. This may allow an attacker to compromise the host server, or steal user data. This is a form of Cross Site Scripting Vulnerability, and can be prevented by checking and escaping user input to the include function, or making sure all includes are not modifiable by users.
