gwendouque

## gist:69d184c3702079c7b0a1e09b2dbd210c
File Inclusion

File inclusion refers to the process of manipulating unsanitised inputs that make use of PHP's include() function into including files that were not intended to be included. This can be used for the disclosure of privileged information (such as the contents of the /etc/shadow file) or including a file that contains some arbitrary code created by the attacker, and thus causing the server to run this code. File inclusion refers in a general sense to the inclusion of an unintended file, whereas file disclosure refers specifically to using file inclusion to obtain sensitive information.
File inclusion is a vulnerability that exists because of PHP's include() function accepting a variable as a parameter.


1 Introduction
2 Remote File Inclusion
3 Local File Inclusion
3.1 Local File Disclosure
	File Inclusion

	File inclusion refers to the process of manipulating unsanitised inputs that make use of PHP's include() function into including files that were not intended to be included. This can be used for the disclosure of privileged information (such as the contents of the /etc/shadow file) or including a file that contains some arbitrary code created by the attacker, and thus causing the server to run this code. File inclusion refers in a general sense to the inclusion of an unintended file, whereas file disclosure refers specifically to using file inclusion to obtain sensitive information.
	File inclusion is a vulnerability that exists because of PHP's include() function accepting a variable as a parameter.


	1 Introduction
	2 Remote File Inclusion
	3 Local File Inclusion
	3.1 Local File Disclosure