Remote File Inclusions (or RFIs for short) are one of the most common remote code execution (RCE) website exploits. The concept is simple: a website vulnerable to RFI allows you to include your own file or script. When you can run close to anything you want on a site, the possibilities are nearly endless.
Commonly, attackers will include the c99 or r57 shells on servers. These will allow direct shell access to the server, which can allow someone to log into the mysql database, download files, edit files, add users, or run arbitrary code.
How it works