VirtueMart Unspecified SQL Injection Vulnerability

Bugtraq ID:	24485
Class:	Input Validation Error
CVE:	CVE-2007-3247
Remote:	Yes
Local:	No
Published:	Jun 15 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	The vendor reported this vulnerability.
Vulnerable:	VirtueMart VirtueMart 1.0.7
Not Vulnerable:	VirtueMart VirtueMart 1.0.11

VirtueMart Unspecified SQL Injection Vulnerability

VirtueMart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerability in the underlying database.

Few technical details are currently available. We will update this BID as more information emerges.

This issue affects versions prior to VirtueMart 1.0.11; other versions may also be vulnerable.

VirtueMart Unspecified SQL Injection Vulnerability

Attackers can exploit this issue via a web client.

VirtueMart Unspecified SQL Injection Vulnerability

Solution:
The vendor has released version 1.0.11 to address this issue; please see the reference section for details.

VirtueMart Unspecified SQL Injection Vulnerability

References:

• Release Name: VirtueMart 1.0.11 (VirtueMart)
  
• Vendor Homepage (VirtueMart)