Doc #79476 [Com]: remote file include

Edit report at https://bugs.php.net/bug.php?id=79476&edit=1

 ID:                 79476
 Comment by:         ragafa5955 at glalen dot com
 Reported by:        c0d1M4x at outlook dot com
 Summary:            remote file include
 Status:             Verified
 Type:               Documentation Problem
 Package:            *Configuration Issues
 Operating System:   Linux/Windows
 PHP Version:        7.2.29
 Block user comment: N
 Private report:     N

 New Comment:

test


Previous Comments:
------------------------------------------------------------------------
[2020-04-15 09:01:37] [email protected]

allow_url_include defaults to Off, and is deprecated as of PHP
7.4.0.  If you enable this setting, you are supposed to know what
you are doing, so this is not a security issue.

I think, though, that this can be documented better.  The security
warning on the include man page[1] isn't as clear is it could be,
and likely a cautionary note should be added to the documentation
of the INI setting[2].  Furthermore, its deprecation has to be
documented.

[1] <https://www.php.net/manual/en/function.include.php>
[2] <https://www.php.net/manual/en/filesystem.configuration.php#ini.allow-url-include>

------------------------------------------------------------------------
[2020-04-14 15:28:16] c0d1M4x at outlook dot com

Description:
------------
[php version]

Test version is php 7.2.27(Centos) and php 7.3.x(Windows)

[linux install command]

yum install php72w-common php72w-fpm php72w-opcache php72w-gd php72w-mysqlnd php72w-mbstring php72w-pecl-redis php72w-pecl-memcached php72w-devel -y

[Issus]

The issus config file is "php.ini".

When "allow_url_include" is set to "On", "auto_prepend_file" and  "auto_append_file" can be set to a remote address and can be successfully included and exploited. This may cause the attacker to use this configuration item to use getshell for a long time in the case of a getshell or other vulnerabilities.




------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=79476&edit=1