Since you have full control over both variables and the ports being opened, your best bet for doing more with this vulnerability is to keep in mind that many internet protocols are just plain text commands sent over an open socket. The significance of this fact is that sending an HTTP request to an open SMTP server can actually trick the SMTP server into sending an email. Chrome actually blocks any attempts to access port 25 via your browser as a result. Here is a good run-down:
The importance here is that you can use the vulnerable server not just to call arbitrary HTTP sites, but you can potentially also use it to spam SMTP servers (resulting in actual emails being sent) and potentially other internet-connected services.
Granted, this isn't a huge leap from where you already are, but you never know what more fun this might give you. If for instance this server is trusted for email sending, you may be able to send emails as the company without having it filtered out as spam. That's not a small thing.
It's possible the hard-coded
http in the
fsocketopen call may be enough to kill the email-sending idea, but it is definitely worth trying. Again, there isn't really anything "special" to differentiate http requests from SMTP requests, so if you can find and connect to a server over the proper port, the fact that PHP considers it an http request doesn't really matter if the remote server accepts your connection.