md5('true') is not authentication: path traversal, an IDOR, and a lazy filter give up a shell.