Description

A critical vulnerability was reported to the VirtueMart team. This vulnerability could be used by a malicious user to easily gain Super-Admin privileges on your website. The bug was patched and the version 2.6.10 (stable version) and 2.9.9b (in RC state) fixes this issue.

Remediation

Upgrade to the latest version of VirtueMart for Joomla! (this issue was fixed in v2.6.10).

References

Security release of VM2.6.10 and VM2.9.9b

Security Advisory - VirtueMart Extension for Joomla!

Related Vulnerabilities

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4550)

WordPress Plugin Social Slider 'rA[]' Parameter SQL Injection (5.6.5)

MyBB Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2012-2325)

Ruby on Rails URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2021-22881)

Ivanti EPMM API Authentication bypass (CVE-2023-35078/CVE-2023-35082)

Severity

High

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Insecure Admin Access Privilege Escalation Known Vulnerabilities Missing Update