Posts on: File-Inclusion

---

Local File Inclusion occurs when an application includes a file whose path is influenced by user input, without proper validation. The impact ranges from source disclosure to full remote code execution — and the gap between the two is smaller than it was a few years ago, because 2024–2026 produced PHP filter-chain techniques that turn a plain php://filter read into arbitrary code execution without allow_url_include, without a log file, and without a writable path.

Remote File Inclusion (RFI) occurs when an application loads a file from a remote URL supplied by the attacker — typically through a PHP include() or require() statement that uses user-controlled input. Unlike LFI, which reads files already on the server, RFI fetches the file from the attacker’s server and executes it, which makes it a direct path to remote code execution without writing anything to disk. The catch: RFI requires allow_url_include = On in php.ini. This is disabled by default since PHP 5.2 and remains off on virtually every modern installation. The vulnerability is therefore less common than LFI, but when it exists, it is the fastest route to RCE — no log poisoning, no file upload, no race condition.