Basic 23 on right track

Hi all

Sadly I cannot figure this one out.

You are on the right track, you just need to think of how you can exploit this vulnerability

I got the above message after putting page= to a URL with a c99.txt on, however I have not managed to get any further with it.

What am I doing wrong? My only thought it maybe it should end in .php but sadly each time I upload the shell to a host it gets me banned - try explaining what a war game is to an uptight web admin :| I would obfuscate the script but then perhaps it will cause me not to pass the challenge?

Thank you.

Basic 23 is down until Mordak gets it fixed.