Can $_SERVER be faked in PHP?

Question

In PHP, Remote file inclusion can be conducted via input from $_GET, $_POST, $_COOKIE. I know it is improbable, but is it possible (by any chance) to fake the value come out of $_SERVER?

I mean, can $_SERVER become the source of Remote file inclusion even on rare occasion?

Answer 1

$_SERVER is an array containing information on paths used to access the request, headers etc.

A number of the values are directly set and manipulated by the user (such as QUERY_STRING) so it is potentially vulnerable in exactly the same way as $_GET and $_POST. That depends on how you use those values in your own code though.

Did you have a specific index of $_SERVER in mind that you wouldn't want faking?

Answer 2

Yes, it's possible to manipulate some of the values in $_SERVER.

However an LFI relies on the attacker being able to inject a reference to the code to be executed and get PHP to execute that code. Unless you intend to ignore everything other than the URL sent in every request (i.e. you are running a static site) then you'll get a lot more mileage out of focussing your efforts on how code referenced by a variable is being invoked.