Vulnerability in VirtueMart for Joomla

Hello 3APA3A!

This is Brute Force vulnerability in VirtueMart for Joomla. Which is at order details page.

Affected products:

Vulnerable are VirtueMart 3.0.9 for Joomla and previous versions.

Details:

Brute Force (WASC-11):

http://site/index.php?option=com_virtuemart&view=orders&layout=details&order_number=1&order_pass=p_11111

Weak password due to limit number of combinations - there are 1048576 combinations in total. If order number is present (which can be known in a result of information leakage or it can be picked up), it leads to leakage of information about order (item, price, name, surname, address and other personal information of client).

Since 2007 I found a lot of such vulnerabilities with weak decimal or hexadecimal passwords in different webapps and web sites. Read about vulnerabilities in WordPress and in WP-DB-Backup plugin, which I found in 2007. About them I mentioned in my article Faulty using of MD5 in web applications (http://websecurity.com.ua/4459/).

Timeline:

2015.05.21 - announced at my site. Later informed admin of the site, where I found this vulnerability, and developers of VirtueMart.
2015.07.29 - disclosed at my site (http://websecurity.com.ua/7770/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua