The page parameter is joined to a directory and opened with no sanitisation. Traverse out to read the flag at /flags/lfi.txt (?page=../../flags/lfi.txt) or /etc/passwd.
Welcome to CWAP Prep Labs. This file is served by the LFI module as the default page.
CWAP Prep Labs · HackXpert Coaching · The XSS Rat · authorized lab use only