Objective
Bypass the authentication panel of the target application without knowing a valid username or password.
Background
The application takes user input from the login form and directly inserts it into a database query without proper sanitization. This is a classic SQL Injection (SQLi) vulnerability.
The Code (Simulated)
The backend is executing a query similar to this:
SELECT * FROM users
WHERE username = 'INPUT_USER'
AND password = 'INPUT_PASS'
How to Exploit
If you can manipulate the input so that the SQL query always evaluates to true, the database will return a record (usually the first one, often 'admin') and log you in.
Try injecting a logical OR condition into the username field and comment out the rest of the query.
Hint: What happens if you enter ' OR '1'='1 as the username?