| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <006d01d0cc9c$e2fa18b0$9b7a6fd5@pc> Date: Sat, 1 Aug 2015 23:58:52 +0300 From: "MustLive" <mustlive@...security.com.ua> To: <submissions@...ketstormsecurity.org>, <fulldisclosure@...lists.org> Subject: [FD] Vulnerability in VirtueMart for Joomla Hello list! This is Brute Force vulnerability in VirtueMart for Joomla. Which is at order details page. ------------------------- Affected products: ------------------------- Vulnerable are VirtueMart 3.0.9 for Joomla and previous versions. ---------- Details: ---------- Brute Force (WASC-11): http://site/index.php?option=com_virtuemart&view=orders&layout=details&order_number=1&order_pass=p_11111 Weak password due to limit number of combinations - there are 1048576 combinations in total. If order number is present (which can be known in a result of information leakage or it can be picked up), it leads to leakage of information about order (item, price, name, surname, address and other personal information of client). Since 2007 I found a lot of such vulnerabilities with weak decimal or hexadecimal passwords in different webapps and web sites. Read about vulnerabilities in WordPress and in WP-DB-Backup plugin, which I found in 2007. About them I mentioned in my article Faulty using of MD5 in web applications (http://websecurity.com.ua/4459/). ------------ Timeline: ------------ 2015.05.21 - announced at my site. Later informed admin of the site, where I found this vulnerability, and developers of VirtueMart. 2015.07.29 - disclosed at my site (http://websecurity.com.ua/7770/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists