Bypassing Login Panel with SQL Queries

http://trentglobal.com/admin

We can use Live HTTP Headers or Hackbar for Post Parameters Injection so i will Use Hackbar For this Process.
Now Lets Insert Some Text in username and password boxes.After Inserting Text Click on LOGIN Button.Then Enable Post Data in Hackbar for the Execution of Our Post Parameters.

Now Click on LOAD URL Button in Hackbar to get POST Parameters in POST DATA box in Hackbar Addon.There we will give our SQL injection Queries.

It gives us Invalid Username and Password but you can See the Post Data in Hackbar Addon.
Here is Our Post Parameter uname=kyfx&pwd=123456&log_submit=Login
let's Add Single Quote after uname=kyfx' to check The SQLi vulnerability.And Then Execute the Query.

It is Vulnerable to SQL Injection.Next we will execute STRING Based SQL Query for Further Injecting.
Now Let's Count how Many Columns are there.
So We will Give our Command For counting Columns in Post Parameters with Hackbar.
uname=kyfx' order by 2%23
No Error !!

uname=kyfx' order by 3%23
No Error !!

uname=kyfx' order by 4%23
No Error !!

uname=kyfx' order by 5%23

We Got Error !!  Unknown column '5' in 'order clause'
it Means There are 4 Total number of Columns.
Hmmm Now Let's Execute our UNION SELECT command with 4 number of Columns.

BinGOOOO!! Admin Panel Bypassed .we have got Access to the Admin Panel Without using Username or Password of the Admin user.