BugMall Shopping Cart 2.5 and previous versions has a default username "demo" and password "demo," which allows remote malicious users to obtain login access.
bugmall shopping cart