LFI
Local File Inclusion (LFI) is when attackers manipulate a file-path parameter so the server includes/reads unintended local files.
Purpose
To understand LFI caused by controllable file paths and its defenses; a common vulnerability in PHP include and similar.
Mechanism
The program includes a user-specified file via include($_GET[page]); the attacker enters ../../etc/passwd to read system files. Defenses: path whitelists, basename, open_basedir.
Use cases
- PHP file inclusion security
- Path traversal defense
- Sensitive file protection