First of all, I would like to say that the LFI and RFI vulnerabilities are found much more frequently
in Web applications developed in PHP or Java than other technologies due to the use that is made of
the function include in these languages.
Let's see some examples to understand where these vulnerabilities come from.
Take the example shown in the slide, the PHP Web page through a combo box allows you to select the name
of a language, and when the page is reloaded, this name is used to generate the name of a file that
is loaded via the include function serverside.
The vulnerability stems from the fact that the GET language variable is not validated before being
used to determine the file name.
So if an attacker values the value of the language parameter in the querystring to a local path or
to a remote URL, in the absence of validation of the parameter value, it opens the side to LFI
or RFI vulnerabilities.
Here we see another example of Java page vulnerable to a LFI/RFI due to lack of validation of the
path created by passing parameter p to the page.
In general, the remedy for these vulnerabilities consists in verifying the path that is determined
through data input based on a white-list of eligible path, discarding any other path value that does
not fall within the white-list of acceptable paths.
Thank you for your kind attention.