Why can URLs such as index.php?page=submit and index.php?page=login warrant file-inclusion testing?
index.php?page=submit
index.php?page=login
Any URL containing a query parameter proves arbitrary files can be included.
The page value is hard-coded and cannot be influenced by a requester.
The user-controlled page value appears to select server-side content that may be included without safe validation.
page
The values prove the application performs SQL queries with no database protection.