2

Some months ago i have patched my magento with:

  • SUPEE-1533
  • SUPEE-5344
  • SUPEE-6285
  • SUPEE-5994
  • SUPEE-6482
  • SUPEE-6788

and i patched using this instruction https://magentary.com/kb/install-supee-6788-without-ssh/ for all the patch. After that i checked with this https://magento.com/security-patch and everithing was ok.

Last week i found inside System->Configuration->General->Design->Html Head->Miscellaneous Scripts a javascript code that was very very strange and i deleted it

In your opinion there is something else i have to check like core files etc...?

Thank you for your suggestion

Improve this question

3 Answers 3

Reset to default
1

This means your site has been hacked, most likely before you applied the patches. Your customer data is at risk! Take the site offline immediately and then start investigating the PHP code and other files.

More details in this answer: What should you do with the hacked installation? (minus the Magento upgrade related points)

Improve this answer
9
  • I followed your post i searched for "base64" and "eval" but also original file of magento 1.9.1 contain that words. In your opinion i could try to replace core files of magento with the original of magento 1.9.1?
    – Ivan
    May 17, 2016 at 14:11
  • Yes, but better make a diff before to see if there actually were any changes, be it from hackers or from an unexperienced developer who modified the core files. It's better to know what has been compromised and what you are changing. And yes, there are occurences of base64 in core files that are not harmful. This search is just a heuristic, you have to look closely at the results.
    – Fabian Schmengler
    May 17, 2016 at 14:24
  • What do you mean with diff?... a compare?....which software can you suggest me?
    – Ivan
    May 17, 2016 at 14:36
  • Yes. kdiff3.sourceforge.net is good. But if you use Git or other version control (which is highly recommended), you already have the functionality.
    – Fabian Schmengler
    May 17, 2016 at 14:39
  • You mean there is already the functionality in magento to do this check? and which folder mainly can you suggest me to check?
    – Ivan
    May 17, 2016 at 15:09
0

1) In your root directory check if you have any other .php files which are not magento installation files. Do the same for some main directories like the app, lib, includes etc.

2) Download your magento installation on the local system and using any editor, search like <?php add 50-100 space after <?php tag this is to ensure if your installation is infected by any malware or not. generally, they add such code on top of the files which are not easily traceable but may make more damage to the store. They add their code after space to view such code we need to scroll the page which we don't do.

3) Check for no. of users in admin and delete if there are some other users other then what you have created.

All the above are the steps to check for infection which I know. You have to at least check for 1) and 3) as you said there was a code added in Miscellaneous Scripts this might be possible.

Improve this answer
2
  • 3) no admin user is present . 1) in root directory there are no files but in the other directory there tousand of files how can i check?
    – Ivan
    May 17, 2016 at 14:12
  • Try with 2) if their any found then you need to check other wise it is OK. Don't forget to change admin password. I think their is no as such thing to worry if it has been affected then you must get atleast single file in root directory so need to check all directory just for sake of confirmation try to 2).
    – Ashish Madankar M2 Professiona
    May 18, 2016 at 3:35
0

Generally if it is in the database in that specific location, the attacker at least has access to admin whether through weak password brute forcing, or he has direct access to database, either way, the database password needs changed and the admin users need to be changed, delete the users that don't need access or are not recognized, change all admin user passwords, etc. Check the php code for changes, although if he had access to the server, it is doubtful he would add the line of code in the database, as there are many better ways to go undetected with access to the server.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.