Remote File Inclusion (RFI) vulnerabilities involve including files from remote locations to execute code. Which option correctly identifies this vulnerability?

• A. Remote File Inclusion (RFI)
• B. SQL Injection
• C. Local File Inclusion (LFI)
• D. Cross-Site Scripting

Answer: (A)

Remote File Inclusion is a vulnerability where a web application includes a file from a remote location as part of its execution. When user input can influence the file path used by include or require, an attacker can cause the server to fetch and run code hosted elsewhere, enabling remote code execution. This differs from Local File Inclusion, which uses files stored on the same server. The other options describe different flaws: SQL Injection targets database queries, and Cross-Site Scripting injects scripts into pages viewed by users. To prevent RFI, ensure user input cannot determine remote resources, validate and sanitize inputs, restrict or whitelist allowed files, and disable remote file inclusion features (like allowing remote URLs) in the server configuration.