I think Boonex guys should honestly admit this. This code is obviously reading a file with admin login and pwd from their Boonex site and inserting it into your admin table. As you all know, an admin can do whatever he wants.

I think their solution was not that smart, because they left one line sql visible which inserts into admin table. Actually it is possible to do it in much smarter ways which are much more difficult to detect and claim.

I don't know how it is in the latest versions. I see more have no time to check newer versions, but if I find anything I am planning to post the details in my Dolphin blog

http://english.youshare.jp/blogs.php?action=show_member_blog&ownerID=15&category=32&cPath=32&blogID=7