I am somewhat positive the security standards are up to par with this login script regarding protection from web app exploits. However, they are using a bad password hashing algorithm. The hashes are salted, but it is best to use bcrypt or scrypt especially if you are going to deploy as part of a public application.
Download link:
Content locked
This content has been locked. Please login or register in order to unlock it.
P.S.: Not sure why the virus scan says it detected a webshell, probably something to do with the ACP, but if you are sketched out, go through every file manually and check the code.