Description: Bludit is a Flat-File CMS, which (in this case) means that Bludit uses files in the JSON format to store the content. We found CMS Version 3.9.2 in CTF Challenge that is vulnerable to Remote code execution by File upload. We completed the challenge but we are excited to find the root cause and analyze the source code . For Analyzing the root cause you have to familiar with basic of php language and .htaccess file What is .Htaccess in PHP ? .htaccess is a configuration file for use on web servers running on the web apache server software. when a .htaccess file is placed in a directory which in turn loaded via the Apache web server, then the .htaccess file is detected and executed by the Apache server software. Whenever any request is sent to the server it always passes through .htaccess file . Htaccess is Used For: 1) A UTHORIZATION, AUTHENTICATION: .htaccess files are often used to specify the...