TIL: The staff group allows you to override binaries' executable paths.
LFI to RCE on GitLab 12.8.1~12.9.0
SQLi for login bypass and embed webshell to an image file