A municipal template engine includes remote URLs supplied by users when rendering pages. What risk class should the tester flag?
Select an answer to reveal the explanation.
Short Explanation
Letting strangers pick what the server pulls in is like letting them choose the next tape for the projector. Remote file inclusion means the app may fetch and run attacker-hosted content. Flag the class and impact path — do not ship a PoC payload cookbook.
Full Explanation
Remote file inclusion arises when an application includes or evaluates content from attacker-influenced remote locations. Depending on language and configuration, that can escalate into remote code execution or serious integrity failures. Testers should document the include mechanism, constraints, and business impact under RoE. Clickjacking, mail-relay TLS, and HSTS issues are separate findings and do not describe remote include risk.