When I upload a php file (file.php) with following content on Apache server
<?php $file = $_GET['file']; include ( $file); ?>
I am able to read any file of Apache using the below URLs
http://domain.com/file.php?file=/etc/passwd http://domain.com/file.php?file=/etc/httpd/conf/httpd.conf http://domain.com/file.php?file=/etc/php.ini http://domain.com/file.php?file=/etc/my.cnf
I am a Linux user so I know common path of the files, they are almost same on all Linux servers.
I do not have control over what code my developers are uploading. The code review process is full of flaws and this type of code can easily be uploaded on the server. Only thing we can do to forbid it through configuration files.
How can I remove this vulnerability from Apache so no one can read system files even if file.php is there in htdocs?