WooYun.org

<?php
//下载文件
define('IN_ADMIN',True);
require_once('include/common.php');
get_login($_USER->id);
$filename=$_GET['urls'];
$phps=explode('/',$filename);
if($phps[0]!='data' && $phps[0]!='ntko'){       //以data或者ntko开头可以绕过
        echo '下载失败！';
        exit;
}
$phps1=explode('.',$filename);
if($phps1[1]=='php'){           //这个判断有逻辑问题，分割后第二个值不为php即可
        echo '下载失败,请不要非法下载！';
        exit;
}
header("Content-Type: application/force-download");
header("Content-Disposition: attachment; filename=".basename($filename));  
readfile($filename);
?>