foreach ($_POST as $item => $value){
$$item=$$value;
$secret = $$item;
}
foreach ($_GET as $key => $value){
if ($key=='flag'){
$str=$value;
$$str=$secret;
}
}
if (isset($hehe)){
echo "<center>".$hehe."</center>";
}
//flag+flaag=flag{XXXXXXX}
代码分析
最终目的是让$hehe=flag,$hehe=flaag
假设post传参admin=789
#$item=admin,$value=789
foreach ($_POST as $item => $value){
$$item=$$value;#$admin=$789
$secret = $$item;#$secret=$789 这里$789我们是可以控制的
}
假设get传参flag=123
foreach ($_GET as $key => $value){
#$key=flag,$value=123
if ($key=='flag'){
$str=$value;#str=123
$$str=$secret;#$123=$secret 这里$123我们是可以控制的
}
}
所以post传入值flag
get传入值hehe
12-06
784
![](https://csdnimg.cn/release/blogv2/dist/pc/img/readCountWhite.png)
08-10
1440
![](https://csdnimg.cn/release/blogv2/dist/pc/img/readCountWhite.png)