Inclusion attacks (LFI/RFI)