If the "extras" folder is placed inside the webroot on osCommerce versions less than v2.2 any file can be read on the target system, including php source code with the database details.
836c86179c8fc75a45bcdf0a06345f8eefef3a8dab21ff18199a17631890737f