Union-Based SQL injection in a file download functionality leads to arbitrary file read

TryHackMe Simple CTF room