php中allow_url_include的應用分析

// Insecure Include
// The following Include statement will
// include and execute everything POSTed
// to the server
include "php://input";
?>

例2: Use data: to Include arbitrary code

// Insecure Include
// The following Include statement will
// include and execute the base64 encoded
// payload. Here this is just phpinfo()
include "data:;base64,PD9waHAgcGhwaW5mbygpOz8+";
?>

把这些放到运算里将会发现既不是url_allow_fopen也不是url_allor_include 被保障。 只是因为过滤器很少对矢量进行过滤。如果要完全解决这个URL include vulnerabilities的方法则需要应用Suhosin扩展。