Description
SQL injection vulnerability in VirtueMart before 1.0.11 allows remote attackers to execute arbitrary SQL commands via unspecified parameters, possibly related to improper input validation of the PATH_INFO (PHP_SELF) by virtuemart_parser.php.
References
- ADV-2007-2217 vdb-entry
- 25698 third-party-advisory
- 36889 vdb-entry
- 24485 vdb-entry
- http://virtuemart.net/index.php?option=com_content&task=view&id=250&Itemid=57
- virtuemart-unspecified-sql-injection(34879) vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=516206