CVE-2011-5230
Seotoaster < 1.9 - SQL Injection via Login or Member Login Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2011-5230. PoCs published by Stefan Schurtz.
AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in Seotoaster v1.9, allowing an attacker to bypass admin authentication by injecting a malicious payload into the username field. The PoC provides a simple URL and credentials to achieve unauthorized access.
Description
Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/LoginModel.php in Seotoaster 1.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to sys/login/index or (2) memberLoginName parameter to sys/login/member.
Exploits (1)
This exploit demonstrates an SQL injection vulnerability in Seotoaster v1.9, allowing an attacker to bypass admin authentication by injecting a malicious payload into the username field. The PoC provides a simple URL and credentials to achieve unauthorized access.