Virtuemart Expert

Today we saw a message on Twitter that Virtuemart has a SQL-Injection problem. This refers to the alert http://www.securityfocus.com/bid/37963/info.

As you can see from the exploit description, this problem only occurs when somebody is logged into the Joomla administration. I would say that this makes it a minor problem - but nervertheless it should be fixed.

We have just uploaded a fix to the virtuemart development server (SVN). If you want to fix the problem on your own before the patch is released, please edit /administrator/components/com_virtuemart/html/order.order_status_form.php and replace line 23 with the following line:

$order_status_id =vmrequest::getInt('order_status_id', 0);

Now the submitted parameter is converted to an integer and no code can be injected to the query.

TrackBack URI for this entry

Comments (1)