Critical Vulnerability in popular Joomla e-commerce extension puts online shops at risk

<div class="separator" style="clear: both; text-align: center;"> <img alt="Joomla" border="0" height="266" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2FFCzXRM-7Px5qwjy6SeUKGe_70yC2LtMIUCs4VmsVYQtRFD_WIoK1du02qZfxeX89XKoJIfbAnkZY0y1qWdImXtLzepQk4S-naq_qrlCq5PFPbicX7VwVARXlAzvgD1DqLihPHMJ8UuQ/s1600/joomlaecommerce-100428418-primary.idge.jpg" title="Joomla" width="400" /></div> <br /> A <b>critical vulnerability</b> in a popular e-commerce extension called <a href="http://extensions.joomla.org/extensions/extension-specific/virtuemart-extensions" target="_blank">VirtueMart extension</a>, which allows users to set up online shops on their sites in the Joomla content management system could allow an attacker to gain super-admin privileges to sites that run the software.<br /> <br /> <b>VIRTUEMART USED BY MILLIONS OF WEBSITES</b><br /> <b><br /></b> This issue is actually serious because VirtueMart is being used by millions of websites. Extension has been downloaded more than 3.5 million times, said Marc-Alexandre Montpas, a researcher at Web security firm <a href="https://sucuri.net/" target="_blank">Sucuri</a>, in a blog post on Wednesday.<br /> <div> <br /></div> <div> <b>WHAT ARE THE RISKS? </b><br /> <b><br /></b></div> <div> A successful exploit would allow an attacker to become a Super-Administrator and do anything as they like, this could include running spam campaigns, uploading backdoors to your server or <a href="http://www.infosecfeeder.com/2014/09/kyle-and-stan-malvertising-network.html" target="_blank">distributing malware</a> to your site users.</div> <div> <br /></div> <div> <div> VirtueMart uses Joomla’s JUser class “bind” and “save” methods to handle user accounts information. That’s not a problem in it of itself, but this class is very tricky and easy to make mistakes with. <a href="http://blog.sucuri.net/2014/09/security-advisory-virtuemart-for-joomla.html" rel="nofollow" target="_blank">said</a> Marc-Alexandre Montpas, a researcher at Web security firm Sucuri. </div> <div> <br /></div> <div> <div> The issue was discovered last week and was patched in VirtueMart 2.6.10, released on Sept. 4. Already the VirtueMart advises users that "<i>everyone using a version lower than 2.6.10 should update as soon as possible for security reasons</i>".</div> <div> <br /></div> <div> Sucuri originally posted technical details about the vulnerability, but now they have removed the details because of the developer's request.<br /> <br /></div> </div> </div> <div> We are removing the technical details as requested. Other extensions might be vulnerable to the same issue, so we will do more research on that. Montpas added. </div> <div> <br /></div> <div> <b>UPDATE NOW</b><br /> <b><br /></b></div> <div> The vulnerability was found in VirtueMart 2.6.8c. VirtueMart have released an update on september 4 to address this problem and all users should update to the latest version ( <b><a href="http://www.smartaddons.com/component/k2/item/1063-important-update-virtuemart-2610-299b-with-security-release" target="_blank">2.6.10</a></b> ) as soon as possible.</div>

Critical Vulnerability in popular Joomla e-commerce extension puts online shops at risk

A critical vulnerability in a popular e-commerce extension called VirtueMart extension , which allows users to set up online shops on th...

Read more »