SSI Injection(Server-side include)
การโจมตีในรูปแบบ Server-side-include เป็นการส่ง command เข้าไปเพื่อประมวลผลในฝั่งของเครื่อง web แอปริเคชั่นนั้นๆ
SSI Injection (Server-side Include) is a server-side exploit technique that allows an attacker to send code into a web application,
which will later be executed locally by the web server. SSI Injection exploits a web application's failure to sanitize user-supplied data
before they are inserted into a server-side interpreted HTML file.
The Server-Side Includes attack allows the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary codes remotely. It can be exploited through manipulation of SSI in use in the application or force its use through user input fields.
If an attacker submits a Server-side Include statement, he may have the ability to execute arbitrary operating system commands, or include a restricted file's contents the next time the page is served.
เช่น
The following SSI tag can allow an attacker to get the root directory listing on a UNIX based system.
< !--#exec cmd="/bin/ls /" -- >
< !--#exec cmd="/usr/bin/less index.php" -->
วิธีการป้องกัน ก็คือ
เพิ่ม disable_functions exec ลงไปใน php.ini ครับ ก็จะป้องกันเคสลักษณะนี้ ได้
