0days shell root

I have a SQL injection into the Webapp of an SS7 gateway. With this vulnerability you can dump the whole database of these devices. In the databases you can found information about the SS7 system, users credentials and Asterisk PBX system. What you need is to scalate that SQL injection into a working root shell. The device runs in CentOS 5, PHP 5.3.3, OpenSSH 4.3, Apache 2.2.15, as you can see, very old software versions, so it will be easy to get a working root shell for someone with some experience.