Dark Mode
Capec-175 Detail
Code Inclusion
Meta Software Likelihood: Medium Typical Severity: Very High
Children: 251 253
Threats: T290
An adversary exploits a weakness on the target to force arbitrary code to be retrieved locally or from a remote location and executed. This differs from code injection in that code injection involves the direct inclusion of code while code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-175 | capec | https://capec.mitre.org/data/definitions/175.html | |
| CWE-829 | cwe | http://cwe.mitre.org/data/definitions/829.html |
Not present
- The target application must include external code/libraries that are executed when the application runs and the adversary must be able to influence the specific files that get included.
- The victim must run the targeted application, possibly using the crafted parameters that the adversary uses to identify the code to include.
- The adversary may need the capability to host code modules if they wish their own code files to be included.
Not present
Not present
- One example of this type of attack pattern is PHP file include attacks where the parameter of an include() function is set by a variable that an attacker is able to control. The result is that arbitrary code could be loaded into the PHP application and executed.