md5('true') is not authentication: path traversal, an IDOR, and a lazy filter give up a shell.

A friendly starter: a file:// wrapper leaks the creds and a UNION injection grabs the flag.