Support

VirtueMart doesn't have a good security track record. This, by itself, is not a problem. The actual problem is that its developer doesn't seem to realize that the reason this keeps happening is his oversight. Instead of admitting responsibility he blames Joomla!.

For example, a few years ago he allowed people to register as Super Users through VirtueMart. This only happened because he was passing the user input blindly to Joomla!'s internal API, without filtering. Do note that this API is supposed to be fed filtered data by definition (it's a Model, not a Controller). Of course someone could alter the request to include a parameter which instructs the internal API to assign any user group to the user. It is very clear to even the most beginner developer that the problem here isn't the internal Joomla! API but the data that was being stupidly fed to it. Everyone understood it... except VirtueMart's lead developer.

There are many incidents like that. In the beginning me and other experienced developers tried to help that guy by pointing out why this keeps happening and how he should defend against silly bugs like that. Unfortunately it was like talking to a brick wall. At some point he devolved the conversation into public, personal attacks against us. At this point we all decided that we can't fix stupid and did the only responsible thing we could do: tell our users to avoid VirtueMart at all cost. It's written by an idiot who doesn't understand the basics of security and won't even bother to at least feign interest in learning how web application security works. When you confront him about it he'll tell you about the time he was an intern in Fraunhoffer Institute, like that means anything. *shrug*

If you are looking for a GOOD e-commerce system for Joomla! I recommend HikaShop. It's far more stable and secure. I have also spoken to the guys developing it. Very good people, they know what they're doing and they do care about security. Does it have security issues? Yeah, at the same rate all complex software of that size does, i.e. a security issue every 1-2 years. Just install the updates and you'll be fine.

Other people I've spoken to and whose opinion I trust have also recommended J2Store. I haven't used it at all so I don't know much about it. I am told that it's much easier to set up, even though not as powerful as HikaShop.

If you want to go outside Joomla!, i.e. run the e-commerce site parallel to the Joomla! site, a great and relatively easy to set up solution is PrestaShop. I've worked with it adding support for it in Akeeba Solo. From the little I've seen it seems powerful and relatively easy to set up. It also has a really good ecosystem of extensions e.g. for integrating payment methods.