The problem of the $_SERVER['REMOTE_ADDR'] is real. Now the master server
has already updated (and now its impossible to get access, because of the
md5 bug) but before you could do this:
http://master.php.net/fetch/docsauth.php?_SERVER[REMOTE_ADDR]=81.57.253.132&token=97669cf8c9a1449eb2099ea6147d125697669cf8c9a1449eb2099ea6147d1256
With this, you had permission to use the script.
Vulnerability fixed. md5 hash will be fixed by Jacques, since he knows what was that secret token he came up with :)
Goba