VirtueMart

The problem is in the file administrator/components/com_virtuemart/html/checkout.2Checkout_result.php, lines 61-62:-

$qv = "SELECT order_id, order_number FROM #__{vm}_orders ";
$qv .= "WHERE order_number='".$order_number."'";

The variable $order_number is obtained directly from the $_REQUEST array on line 38:-

$order_number = $_REQUEST['merchant_order_id'];

It is not escaped anywhere.

Thanks to Fiona Coulter from Spiral Scripts for reporting.