CWE-98 (PHP程序中Include/Require语句包含文件控制不恰当(PHP远程文件包含)) — Vulnerability Class 1085

CWE-98 represents a critical input validation weakness where PHP applications fail to properly sanitize user-supplied data before passing it to include or require functions. Attackers typically exploit this by injecting malicious URLs or local file paths, enabling Remote File Inclusion (RFI) or Local File Inclusion (LFI). This allows adversaries to execute arbitrary code hosted on external servers or access sensitive system files, often leading to full server compromise. To mitigate this risk, developers must strictly validate and whitelist allowed filenames or paths, ensuring only expected local resources are included. Additionally, disabling the allow_url_include and allow_url_fopen directives in the PHP configuration prevents the inclusion of remote files entirely. Implementing robust input validation and adhering to the principle of least privilege significantly reduces the attack surface associated with dynamic file inclusion mechanisms.