VScanner's Knowledge Base
  • Welcome to VScanner Documentation
  • VScanner API
    • Introduction
      • Classification
    • Authentication
    • Vulnerability Scanner
      • Scans
        • Explorer Preferences
          • Features
        • Website Vulnerability Preferences
          • Features
        • Scan API Preferences
          • Features
        • Subdomain Finder
    • PDF Report Generation
    • PDF Report AI Action Plan
  • FAQ (Frequently Asked Questions)
    • Account & Subscription
      • Can I change my subscription at any time?
      • Can I delete my account at any time?
      • Which payment methods does VScanner accept?
    • Scans & Reports
      • Can I export the scan result to PDF?
      • I fixed the vulnerabilities found on the last scan, how do I run a new one?
      • How often can I run a scan?
      • How long will it take for a scan to complete?
      • What is a target on VScanner?
      • How to scan a website on VScanner?
      • How does VScanner work?
    • Web Security Vulnerabilities
      • How to protect from cyber attacks?
      • List of OWASP TOP 10 vulnerabilities for 2021-2022
      • What are the most common vulnerabilities on websites?
      • How to fix - Broken Access Control
      • How to fix - Extension Vulnerabilities
      • How to fix - Plugin Vulnerabilities
      • How to fix - CMS Vulnerability
      • How to fix - Weak HTTPS Configurations
      • How to fix - Invalid HTTPS Certificates
      • How to fix - Session Failure
      • How to fix - Validation Failure
      • How to fix - Authorization Failure
      • How to fix - Weak Authentication
      • How to fix - Sensitive Data Exposure
      • How to fix - Cross-Site Request Forgery (CSRF)
      • How to fix - Local File Injection (LFI)
      • How to fix - Remote File Injection (RFI)
      • How to fix - Cross-Site Scripting (XSS)
      • How to fix - Command Injection
      • How to fix - SQL Injection
Powered by GitBook
On this page
  1. FAQ (Frequently Asked Questions)
  2. Web Security Vulnerabilities

How to fix - Local File Injection (LFI)

Local File Injection (LFI) is a type of web application vulnerability that allows an attacker to read sensitive files on the web server. This can include configuration files, log files, and even source code. LFI can occur when an application takes user-supplied input and uses it to construct a file path without properly validating or sanitizing the input.

To fix LFI, the web application should properly validate and sanitize user-supplied input. This can include limiting the types of characters that can be used in the input, and checking that the input corresponds to an existing file. Additionally, sensitive files should be stored outside of the web root, so that they are not accessible via the web server.

Another way to fix LFI is by using a whitelist of accepted input, which only allows specific characters or strings to be passed to the file path.

In addition, it is important to keep the web server and web application software up-to-date, as many LFI vulnerabilities are discovered and patched by software vendors.

It is also important to use security best practices and perform regular security assessments to identify and remediate vulnerabilities in the application.

PreviousHow to fix - Cross-Site Request Forgery (CSRF)NextHow to fix - Remote File Injection (RFI)

Last updated 1 year ago