PT-2012-2207 · Seotoaster · Seotoaster

Stefan Schurtz · Published 2012-10-25 · Updated 2017-08-29 · CVE-2011-5230

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Seotoaster versions 1.9 and earlier

Description The issue concerns SQL injection vulnerabilities in the selectUserIdByLoginPass function. Remote attackers can execute arbitrary SQL commands via the login parameter to "sys/login/index" or the memberLoginName parameter to "sys/login/member".

Recommendations For Seotoaster versions 1.9 and earlier, as a temporary workaround, consider disabling the selectUserIdByLoginPass function until a patch is available. Restrict access to the "sys/login/index" and "sys/login/member" API endpoints to minimize the risk of exploitation. Avoid using the login and memberLoginName parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2011-5230

Affected Products

Seotoaster

References · 7

• 🔥 https://exploit-db.com/exploits/18246 · Exploit
• 🔥 http://exploit-db.com/exploits/18246 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5230 · Security Note
• http://secunia.com/advisories/46881 · Vendor Advisory
• http://infoserve.de/system/files/advisories/INFOSERVE-ADV2011-06.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71843 · Note
• http://osvdb.org/77736 · Note