CEH Web Application and Injection Attacks Practice Question
During a penetration test, you find a web application that includes files using a parameter like /index.php?page=about. When you change the parameter to /etc/passwd, the application returns the contents of the password file. Which vulnerability is present?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Local File Inclusion (LFI)
Local File Inclusion (LFI) allows an attacker to include local files on the server through path traversal or direct inclusion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Local File Inclusion (LFI)
Why this is correct
Local File Inclusion (LFI) occurs when a web application incorporates a local file into its output or execution flow based on user-supplied input without adequate validation. An attacker can manipulate parameters to point to arbitrary files on the server's filesystem, such as `/etc/passwd` or application log files. This vulnerability allows for sensitive data disclosure, and in some cases, can be escalated to remote code execution by including log files poisoned with malicious code.
- ✗
Remote File Inclusion (RFI)
Why it's wrong here
Remote File Inclusion (RFI) is a vulnerability where a web application includes a remote file, typically specified via a URL in user input, into its server-side script execution. Unlike LFI, RFI directly enables an attacker to execute arbitrary code hosted on an external server by tricking the application into fetching and running it. This often leads to immediate remote code execution, giving the attacker full control over the compromised server.
- ✗
Command Injection
Why it's wrong here
Command Injection involves an attacker executing arbitrary operating system commands on the host server by injecting them into an application's input fields. This vulnerability arises when an application passes user-supplied data directly to a system shell without proper sanitization, allowing the attacker to append or modify commands. Its primary goal is direct command execution, distinct from merely including or reading files.
- ✗
Directory Traversal
Why it's wrong here
Directory Traversal, also known as Path Traversal, allows an attacker to access files and directories stored outside the intended root directory of a web application. By manipulating file paths with sequences like `../`, an attacker can navigate the filesystem to read or sometimes write arbitrary files. While it enables access to files, it does not involve the application *including* the content of those files into its processing or output in the same manner as an LFI vulnerability.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.