Database credential disclosure via unsanitized login input

SQL injection in phpABook 0.9i allows remote attackers to read administrator password hashes through auth_user in index.php. The login handler incorporates auth_user into an SQL query without sufficient sanitization, enabling a time-based blind payload to extract the administrator hash one character at a time. No authentication or user interaction is required; exploitation sends crafted POST requests to the exposed login page and discloses database-held credentials.