{"id":5590,"date":"2011-02-08T12:39:28","date_gmt":"2011-02-08T12:39:28","guid":{"rendered":"https:\/\/www.webstix.com\/2011\/02\/08\/virtuemart-sql-injection-vulnerability\/"},"modified":"2011-02-08T12:39:28","modified_gmt":"2011-02-08T12:39:28","slug":"virtuemart-sql-injection-vulnerability","status":"publish","type":"post","link":"https:\/\/staging.webstix.net\/WSX\/wp\/support-blog\/virtuemart-sql-injection-vulnerability\/","title":{"rendered":"VirtueMart SQL Injection Vulnerability"},"content":{"rendered":"\n<p>If your website is using VirtueMart and you host with us, we will be upgrading your site with a patch:<\/p>\n<blockquote>\n<p><strong>VirtueMart &quot;search_category&quot; SQL Injection Vulnerability<\/strong><\/p>\n<p>Description<br \/>   Andrea Fabrizi has discovered a vulnerability in VirtueMart, which can be exploited by malicious people to conduct SQL injection attacks.<\/p>\n<p>Input passed via the &quot;search_category&quot; parameter to index.php (when &quot;option&quot; is set to &quot;com_virtuemart&quot; and &quot;page&quot; is set to &quot;shop.browse&quot;) is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.<\/p>\n<p>The vulnerability is confirmed in version 1.1.6. Other versions may also be affected.<\/p>\n<p>Solution<br \/>     Apply patch.<br \/>     Further details available in Customer Area<\/p>\n<p>Provided and\/or discovered by<br \/>     Andrea Fabrizi<\/p>\n<p>Original Advisory<br \/>     VirtueMart:<br \/>     <a href=\"https:\/\/dev.virtuemart.com\/projects\/virtuemart\/activity\" target=\"_blank\" rel=\"noopener\">https:\/\/dev.virtuemart.com\/projects\/virtuemart\/activity<\/a><\/p>\n<\/blockquote>\n<p>This patch will take 1 Maintenance Block to install and test. <\/p>\n<p>Thanks,<br \/>   -Tony<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If your website is using VirtueMart and you host with us, we will be upgrading your site with a patch: VirtueMart &quot;search_category&quot; SQL Injection Vulnerability Description Andrea Fabrizi has discovered a vulnerability in VirtueMart, which can be exploited by malicious people to conduct SQL injection attacks. Input passed via the &quot;search_category&quot; parameter to index.php (when [&hellip;]<\/p>\n","protected":false},"author":468,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[6],"tags":[],"class_list":["post-5590","post","type-post","status-publish","format-standard","hentry","category-support-blog"],"acf":[],"_links":{"self":[{"href":"https:\/\/staging.webstix.net\/WSX\/wp\/wp-json\/wp\/v2\/posts\/5590","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/staging.webstix.net\/WSX\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/staging.webstix.net\/WSX\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/staging.webstix.net\/WSX\/wp\/wp-json\/wp\/v2\/users\/468"}],"replies":[{"embeddable":true,"href":"https:\/\/staging.webstix.net\/WSX\/wp\/wp-json\/wp\/v2\/comments?post=5590"}],"version-history":[{"count":0,"href":"https:\/\/staging.webstix.net\/WSX\/wp\/wp-json\/wp\/v2\/posts\/5590\/revisions"}],"wp:attachment":[{"href":"https:\/\/staging.webstix.net\/WSX\/wp\/wp-json\/wp\/v2\/media?parent=5590"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/staging.webstix.net\/WSX\/wp\/wp-json\/wp\/v2\/categories?post=5590"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/staging.webstix.net\/WSX\/wp\/wp-json\/wp\/v2\/tags?post=5590"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}