PT-2017-7893 · Joomla · Virtuemart

Code16 · Publicado 2017-05-29 · Atualizado 2017-06-08 · CVE-2016-10379

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VirtueMart com virtuemart component version 3.0.14 for Joomla!

Description The issue allows SQL injection by remote authenticated administrators. This can be achieved via the virtuemart paymentmethod id or virtuemart shipmentmethod id parameter to the "administrator/index.php" endpoint.

Recommendations For VirtueMart com virtuemart component version 3.0.14, consider restricting access to the virtuemart paymentmethod id and virtuemart shipmentmethod id parameters in the administrator/index.php endpoint until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2016-10379

Produtos afetados

Virtuemart

Referências · 4

• 🔥 http://code610.blogspot.com/2016/08/testing-sql-injections-in-comvirtuemart.html · Exploit
• https://osv.dev/vulnerability/CVE-2016-10379 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10379 · Nota de Segurança
• http://securityfocus.com/bid/98753 · Nota