This script is possibly vulnerable to file inclusion attacks.
It seems that this script includes a file which name is determined using user-supplied data. This data is not properly validated before being passed to the include function.
Edit the source code to ensure that input is properly validated. Where is possible, it is recommended to make a list of accepted filenames and restrict the input to that list.
For PHP, the option allow_url_fopen would normally allow a programmer to open, include or otherwise use a remote file using a URL rather than a local file path. It is recommended to disable this option from php.ini.
- WordPress Plugin Brandfolder-Digital Asset Management Simplified Local/Remote File Inclusion (3.0)
- WordPress Plugin BackWPup 'wp_export_generate.php' Local and Remote File Include Vulnerabilities (2.1.4)
- WordPress Plugin Eventify-Simple Events 'npath' Parameter Remote File Include (1.7.g)
- Zabbix 1.8.x-2.2.x Local File Inclusion via XXE Attack
- WordPress Plugin Shortcode Factory Local File Inclusion (2.7)