2

I have been scanning the website at Magento Scan and getting the following error:

Magento Compromise Injection
Your site is compromised with injected JavaScript. (131) The malicious code signature(s) has been found on the page.

In page source I can clearly see a malicious script included in header.

After further research I found that there are entries in core_config_data with path : 'design/head/includes' and the value column has that malicious script.

I have not changed nor uploaded any extensions.

This has happened 3 to 4 times earlier and I am able to track how is this being injected.

When it happened for the first time and for every other times, I have changes database credentials but it didn't helped.

What measures should I take to prevent this?

Improve this question

2 Answers 2

Reset to default
2

Changing the database credentials only will not help. You may need to change the following:

  • Admin Panel URL path
  • Admin Panel login credentials
  • Check if there are any other admin users created
  • Hosting Panel credentials
  • FTP Login details (if any)
  • SSH credentials

You also need to check whether there are any FTP, SSH users created without your knowledge.

Apart from above, if you are not using SSL (HTTPS) for your website, please ask your hosting provider to install it for you.

Please let me know if you are not sure how to check above details.

Improve this answer
5
  • 1
    Alright will change all of the above and update you.
    – Wasiq Shahrukh
    Commented Jul 2, 2018 at 8:37
  • 1
    Also check for backdoors, eg webshells under /skin. See mwscan for a Magento malware scanner.
    – Willem
    Commented Jul 3, 2018 at 19:09
  • 1
    I have just installed Google's Invisible reCaptcha on the website for all forms and since then there are no such issues found. I wonder how can any script enter anything in database from magento's default forms.
    – Wasiq Shahrukh
    Commented Jul 16, 2018 at 6:24
  • 1
    @Willem I have found some backdoors and other malware codes in skin as well as in some of my code files for blog. I have removed all of them and changed the dir permissions to 755 and for files 644. Before the permissions were 777 for all.
    – Wasiq Shahrukh
    Commented Jul 16, 2018 at 7:27
  • @WasiqShahrukh, great work.
    – Mohit Kumar Arora
    Commented Jul 16, 2018 at 7:39
2

Remember that almost all the configuration stores in the table: core_config_data In this case:

SELECT * FROM core_config_data where path like '%design/head/includes%';
Improve this answer
1
  • Sometimes malware is hidden in the cms_blocks and cms_pages tables. To be sure, you should scan your whole SQL dump.
    – Willem
    Commented Jul 16, 2018 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.