That's actually a whole lot worse than the AM version here. The MD5 hashes themselves are usable as valid password! And the cracking of the MD5 hash back to or

That's actually a whole lot worse than the AM version here. The MD5 hashes themselves are usable as valid password! And the cracking of the MD5 hash back to original password is fully amenable to rainbow tables. All you need is hashes which you can extract from DB or webserver logs... Or sslstrip'd/HTTP traffic if that's possible.