CVE-2011-5230 Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/LoginModel.php in Seotoaster 1.9 and earlier allow remote attackers to execute arbi...
HighCVSS 7.5
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/LoginModel.php in Seotoaster 1.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to sys/login/index or (2) memberLoginName parameter to sys/login/member.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| seotoaster | <= 1.9 | No fix listed |
| seotoaster | = 1.8.2 | No fix listed |
| seotoaster | = 1.8.3 | No fix listed |
References
- 77736 vdb-entry
- 46881 third-party-advisory vendor-advisory
- 18246 exploit
- www.infoserve.de
- seotoaster-loginmodel-sql-injection(71843) vdb-entry