SB2017010402 - SQL injection in Joomla! aWeb Cart Watching System for Virtuemart component

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017010402

SB2017010402 - SQL injection in Joomla! aWeb Cart Watching System for Virtuemart component

Published: January 4, 2017 Updated: January 5, 2017

Security Bulletin ID SB2017010402
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) SQL injection (CVE-ID: CVE-2016-10114)

The vulnerability allows a remote attacker to execute arbitrary SQL commands in vulnerable application.

The vulnerability exists in aWeb Cart Watching System for Virtuemart for Joomla! due  to insufficient sanitization of user-supplied data passed via "categorysearch" and "smartSearch" parameters. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in web application database.

Successful exploitation may allow an attacker to gain complete control over vulnerable website.


Remediation

Install update from vendor's website.

References