login script for guestbook allows bypassing authentication by setting a "login_ok" parameter to 1.
CVE-2009-2382
admin script allows authentication bypass by setting a cookie value to "LOGGEDIN".
CVE-2009-1048