PT-2017-7893 · Joomla · Virtuemart

Code16 · Published 2017-05-29 · Updated 2017-06-08 · CVE-2016-10379

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VirtueMart com virtuemart component version 3.0.14 for Joomla!

Description The issue allows SQL injection by remote authenticated administrators. This can be achieved via the virtuemart paymentmethod id or virtuemart shipmentmethod id parameter to the "administrator/index.php" endpoint.

Recommendations For VirtueMart com virtuemart component version 3.0.14, consider restricting access to the virtuemart paymentmethod id and virtuemart shipmentmethod id parameters in the administrator/index.php endpoint until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-10379

Affected Products

Virtuemart

References · 4

• 🔥 http://code610.blogspot.com/2016/08/testing-sql-injections-in-comvirtuemart.html · Exploit
• https://osv.dev/vulnerability/CVE-2016-10379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10379 · Security Note
• http://securityfocus.com/bid/98753 · Note