BugKuCTF——代码审计–extract变量覆盖
<?php
$flag
='xxx';
extract($_GET
);
if(isset($shiyan
))
{
$content
=trim(file_get_contents($flag
));
if($shiyan
==$content
)
{
echo
'flag{xxx}';
}
else
{
echo
'Oh.no';
}
}
?>
漏洞：extract()函数在传入数值的时候把已有的的值替换掉，所以直接goujianpayload：
?shiyan
=&flag
=
