Lab Scan - Security Hole

<?php
header( 'Content-Type: text/xml' );

// DEFINE SHIT
define( 'TEMPLATE',
"<?xml version=\"1.0\"?>
<danscan>
   <finished time=\"%d\" timestr=\"%s\" />
%s</danscan>
" );

// INIT SCAN RANGE
$start  = @$_GET['start']  ? (int)$_GET['start'] : 1;
$end    = @$_GET['end']    ? (int)$_GET['end']   : 62;
$prefix = @$_GET['prefix'] ? $_GET['prefix']     : 'dog';

// ERROR TRAP
if( $start > $end )
   die( sprintf( TEMPLATE,
        time(NULL),
        date('jS \of F Y h:i:s A'),
        '<error>$start > $end</error>' ) );
elseif( $start < 0 )
   die( sprintf( TEMPLATE,
        time(NULL),
        date('jS \of F Y h:i:s A'),
        '<error>$start < min</error>' ) );

// BEGIN GENERATING SCAN RESULTS
$write = '';
for( $i = $start; $i <= $end; $i++ ){
   $mac = sprintf( "$prefix%02d", $i );
   $write .= "   <host name=\"$mac\" status=\"".scan( $mac )."\" />\n";
}

// OUTPUT RESULTS
printf( TEMPLATE, time(NULL), date('jS \of F Y h:i:s A'), $write );

// HELPERS
function scan( $mac ) {
   $test = shell_exec( "/bin/nc -zv -w 1 $mac 22 2>&1| /bin/cat -" );
   print $test;

   if( strpos( $test, 'open' ) !== false )
      return 'linux';
   if( strpos( $test, 'Connection refused' ) !== false )
      return 'windows';
   return 'offline';
}