Number: IRCNE2014092316
Date: 2014-09-14
According to “techworld”, a critical vulnerability in a popular e-commerce extension for the Joomla content management system allows malicious users to gain super-admin privileges to sites that run the software.
The VirtueMart extension, which allows users to set up online shops on their websites, has been downloaded more than 3.5 million times, said Marc-Alexandre Montpas, a researcher at Web security firm Sucuri, in a blog post Wednesday. "With super-admin access, the attacker has full control of the site and database."
The issue was discovered last week and was patched in VirtueMart 2.6.10, released on Sept. 4. The VirtueMart page in the Joomla extensions catalogue advises users that "everyone using a version lower than 2.6.10 should update as soon as possible for security reasons."
"VirtueMart uses Joomla's JUser class 'bind' and 'save' methods to handle user accounts information," Montpas said. "We actually think the problem is on the Joomla class itself, so we will not disclose any more details."
- 2