Academy command injection final

Can someone help me with this?

I’m pretty sure this is the injection point.

then I’ve tried
I’m using & as the injection command cause |, ;, %0a gets flagged as malicious so I do tmp&c\a\t${IFS}
${PATH:0:1}flag.txt as my payload, but nothing returns… I’m doiing it on the to parameter and I’ve tried every parameter with no luck. Any help is appreciated.