Which vulnerability involves modifying input to embed path traversal sequences to reach restricted directories?

Which vulnerability involves modifying input to embed path traversal sequences to reach restricted directories?

• A. CSPP attacks
• B. Directory Traversal Attack
• C. Canonicalization
• D. Local File Inclusion (LFI)

Answer: (D)

Local File Inclusion is exposed when an application takes a file path from user input and uses it to read or include a file without proper validation. An attacker can inject path traversal sequences (for example, ../../) into that input to step out of the intended directory and reach restricted or sensitive files. The vulnerability lies in how the application processes the user-controlled path, allowing access to files it should not expose. While the technique often involves traversing directories, the specific flaw is the insecure inclusion or reading of local files based on untrusted input. Proper fixes include validating and sanitizing input, restricting to whitelisted paths, and using safe file access APIs.

Local File Inclusion is exposed when an application takes a file path from user input and uses it to read or include a file without proper validation. An attacker can inject path traversal sequences (for example, ../../) into that input to step out of the intended directory and reach restricted or sensitive files. The vulnerability lies in how the application processes the user-controlled path, allowing access to files it should not expose. While the technique often involves traversing directories, the specific flaw is the insecure inclusion or reading of local files based on untrusted input. Proper fixes include validating and sanitizing input, restricting to whitelisted paths, and using safe file access APIs.