Y.A.N.S sql injection

[escalation666]

Product: YANS (yet another news system)

Link:

vuln'>http://sourceforge.net/projects/yans/

vuln code:

$resultado = mysql_query("SELECT * FROM users WHERE

username='$username' AND password='$password'") or die (mysql_error());

simple sql injection

' or '1=1

' or '1=1

-navairum

[Spy_bit]

wow man asta e sql injecion