PT-2007-4526 · Virtuemart · Virtuemart

Publicado 2007-06-18 · Atualizado 2017-07-29 · CVE-2007-3247

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: VirtueMart versions prior to 1.0.11

Description: The issue allows remote attackers to execute arbitrary SQL commands, possibly due to improper input validation of the PATH INFO (PHP SELF) by virtuemart parser.php. This can be achieved via unspecified parameters.

Recommendations: For versions prior to 1.0.11, update to version 1.0.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the virtuemart parser.php file to minimize the risk of exploitation. Avoid using unspecified parameters in the affected API endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-3247

Produtos afetados

Virtuemart

Referências · 9

• http://secunia.com/advisories/25698 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/2217 · Nota
• http://securityfocus.com/bid/24485 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3247 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3247 · Nota
• http://sourceforge.net/project/shownotes.php?release_id=516206 · Nota
• http://virtuemart.net/index.php?option=com_content&task=view&id=250&Itemid=57 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34879 · Nota
• http://osvdb.org/36889 · Nota