[Androme]

Is it simply a case of a SQL injection? Or just a case of him taking a hash and using javascript to create a cookie and login based on that hash?

Like I said, there's no way in hell he would know what the password actually is unless he knew the salted hash (as then the clear text password wouldn't be too hard to figure out).