LFI (Local File Inclusion)

The application includes a server file based on a URL parameter.

• Log Poisoning — inject PHP into User-Agent, the log saves it, the LFI executes it.
• PHP wrappers — php://filter/convert.base64-encode/resource= to read source code without executing.
• Session poisoning — write payload into a session file and include it via LFI.

// VULNERABLE
include($_GET['page'] . '.php');

// SAFE
$pages = ['home' => 'home.php', 'about' => 'about.php'];
$page = $pages[$_GET['page']] ?? 'home.php';
include(__DIR__ . '/views/' . $page);