PHP Misconfiguration: allow_url_fopen Enabled

Operating on remote files can allow an attacker to inject malicious content into the program.

When enabled, the allow_url_fopen option allows PHP functions that accept a filename to operate on remote files using an HTTP or FTP URL. The option, which was introduced in PHP 4.0.4 and is enabled by default, is dangerous because it can allow attackers to introduce malicious content into an application. At best, operating on remote files leaves the application susceptible to attackers who alter the remote file to include malicious content. At worst, if attackers can control a URL that the application operates on, then they can inject arbitrary malicious content into the application by supplying a URL to a remote server.

Example 1: The following code opens a file whose name is controlled by a request parameter and reads its contents. Because the value of $file is controlled by a request parameter, an attacker could violate the programmer's assumptions by providing a URL to a remote file.

<?php
$file = fopen ($_GET["file"], "r");
if (!$file) {
    // handle errors
}
while (!feof ($file)) {
    $line = fgets ($file, 1024);
    // operate on file content
}
fclose($file);
?>