It's duplicate content. As with all duplicate content, it's not necessarily a direct penalty, but Google will only display one of the duplicate URLs. Google decides. If you are internally linking to the non-rewritten URLs then it is likely that Google will not even see your pretty/user friendly URLs and choose your non-rewritten URLs to display in the SERPs.
If you wish to take advantage of the nice looking / rewritten URLs then 301 redirect from the non-rewritten to the rewritten URLs (and link to these internally).
However, Google does not mind whether your URLs look "pretty" or contain querystrings, it will index both methods equally well (but use one or the other). Users tend to prefer the "pretty" ones.