Remember once phpmyadmin 4.8.1 Remote File Inclusion Vulnerability (BUUCTF web)

The questions were very simple, a funny

Open source, found source.php file

 

Then access the files found appear a bunch of php source

 

Indicate the presence of hint.php, then find a word access

flag not here, and flag in ffffllllaaaagggg

Then back to question clearly observed source.php a code audit, wherein there are four limitations

$ _REQUEST [ 'file'] needs in the white list, whitelist only source.php and hint.php

$ _REQUEST [ 'file'] is not empty

$ _REQUEST [ 'file'] must be a string

$ _REQUEST [ 'file'] needs to bypass function checkFile

So consider the construction paylaod, index.php? File = hint.php? / Ffffllllaaaagggg

I found a blank page, so by Baidu, which is a phpmyadmin 4.8.1 Remote File Inclusion Vulnerabilities

https://www.cnblogs.com/leixiao-/p/10265150.html

You can get through get through the directory file flag

So build payload again, / index.php? File = hint.php? /../../../../ ffffllllaaaagggg

Gets flag

flag{k9oct67wctkmbsdkhi32yiip74vsqlvu}