PT-2007-4526 · Virtuemart · Virtuemart

Published 2007-06-18 · Updated 2017-07-29 · CVE-2007-3247

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: VirtueMart versions prior to 1.0.11

Description: The issue allows remote attackers to execute arbitrary SQL commands, possibly due to improper input validation of the PATH INFO (PHP SELF) by virtuemart parser.php. This can be achieved via unspecified parameters.

Recommendations: For versions prior to 1.0.11, update to version 1.0.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the virtuemart parser.php file to minimize the risk of exploitation. Avoid using unspecified parameters in the affected API endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2007-3247

Affected Products

Virtuemart

References · 9

• http://secunia.com/advisories/25698 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3247 · Security Note
• http://virtuemart.net/index.php?option=com_content&task=view&id=250&Itemid=57 · Patch
• http://vupen.com/english/advisories/2007/2217 · Note
• http://securityfocus.com/bid/24485 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3247 · Note
• http://sourceforge.net/project/shownotes.php?release_id=516206 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34879 · Note
• http://osvdb.org/36889 · Note