Joomla! Component com_virtuemart 2.0.22a – SQL Injection

• Exploit Database
• 14 阅读

• 作者： Matias Fontanini
  日期： 2013-08-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/27879/

• ------------------------------------------------------------
  Joomla! VirtueMart component <= 2.0.22a - SQL Injection
  ------------------------------------------------------------
  
  == Description ==
  - Software link: http://www.virtuemart.net/
  - Affected versions: All versions between 2.0.8 and 2.0.22a are vulnerable.
  - Vulnerability discovered by: Matias Fontanini
  
  == Vulnerability ==
  The vulnerability is located in the "user" controller, "removeAddressST" 
  task. The "virtuemart_userinfo_id" parameter is not properly sanitized 
  before being used in the "DELETE" query performed in it, allowing the 
  execution of arbitrary SQL queries.
  
  In order to exploit the vulnerability, an attacker must be authenticated 
  as a customer in the application. However, since the system allows free 
  account registration, this is not a problem.
  
  == Proof of concept ==
  The following example URL uses the MySQL "sleep" function through the 
  injection:
  
  http://example.com/index.php?option=com_virtuemart&view=user&task=removeAddressST&virtuemart_userinfo_id=16%22%20and%20sleep(10)%20and%20%22%22%3D%22
  
  == Solution ==
  Upgrade the product to the 2.0.22b version.
  
  == Report timeline ==
  [2013-08-15] Vulnerability reported to vendor.
  [2013-08-16] Developers answered back.
  [2013-08-22] VirtueMart 2.0.22b was released, which fixes the the 
  reported issue.
  [2013-08-22] Public disclosure.