Local file inclusion (LFI)/remote file inclusion (RFI) are PHP based vulnerabilities. LFI occurs when application includes a file as user input without properly validating it while RFI occurs when web application receives inputs that includes path to file but isn’t properly sanitized.
LFI is where attacker uploads malicious scripts as a file to the server side to be executed locally, hence the name local file inclusion. The key word here is locally. RFI on the other hand is where attacker loads file from external sourcing outside the servers. Usually, these two are utilized together. For LFI, attackers are done with vulnerability scanning web and application firewalls while RFI attacks are done with blacklisting and code fixing. Both of these attacks are due to bad input validation and can be prevented with tricks like disabling remote inclusion feature and disabling URL open option. To react and recover quickly, ensure admins have quick restore and back up ready to go.
HansITAcademy 