1

Problem: Magento checkout redirects back to the cart after selecting shipping method

Environment: Magento 1.4.0.1, CentOS 5.5 (behind an nginx/0.8.53 proxy), Apache/2.2.3, Linux 2.6.18-194.26.1.el5xen x86_64

Steps to Reproduce:

Clues:

There has been an error processing your request Notice: Undefined
index: SESSIIID  in
/var/www/gentlemanjoe.com/app/code/core/Mage/Payment
/Model/Method/Cc.php on line 388
Trace:
#0 /var/www/gentlemanjoe.com/app/code/core/Mage/Payment/Model/Method/Cc.php(388):
mageCoreErrorHandler (8, 'Undefined index...', '/var/www/gentle...',
388, Array)
#1 /var/www/gentlemanjoe.com/lib/Varien/Autoload.php(93): include('/var/www/gentle...')
#2 [internal function]: Varien_Autoload->autoload('Mage_Payment_Mo...')
#3 /var/www/gentlemanjoe.com/app/code/core/Mage/Payment/Model/Method/Ccsave.php(29):
spl_autoload_call ('Mage_Payment_Mo...')
#4 /var/www/gentlemanjoe.com/lib/Varien/Autoload.php(93): include('/var/www/gentle...')
#5 [internal function]: Varien_Autoload->autoload('Mage_Payment_Mo...')
#6 [internal function]: spl_autoload_call('Mage_Payment_Mo...')
#7 /var/www/gentlemanjoe.com/app/code/core/Mage/Core/Model/Config.php(1204):
class_exists('Mage_Payment_Mo ...')
#8 /var/www/gentlemanjoe.com/app/Mage.php(432): Mage_Core_Model_Config->getModelInstance('payment /method_...',
Array)
#9 /var/www/gentlemanjoe.com/app/code/core/Mage/Payment/Helper/Data.php(70):
Mage::getModel('payment /method_...')
#10 /var/www/gentlemanjoe.com/app/code/core/Mage/Payment/Block/Form/Container.php(117):
Mage_Payment_Helper_Data- >getStoreMethods('1',
Object(Mage_Sales_Model_Quote))
#11 /var/www/gentlemanjoe.com/app/code/core/Mage/Payment/Block/Form/Container.php(44):
Mage_Payment_Block_Form_Container- >getMethods()
#12 /var/www/gentlemanjoe.com/app/code/core/Mage/Core/Block/Abstract.php(211):
Mage_Payment_Block_Form_Container- >_prepareLayout()

... I cut it off for brevity. You can see the full stack trace at https://gentlemanjoe.com/errors/report.php?id=448265828398&skin=default

Background:

I am not the original developer of the site, just helping the owners troubleshoot this issue, which began on May 27 with seemingly no changes on their end. I have zero Magento knowledge and only basic PHP experience.

Any ideas?

  • Why is the website you posted a Shopify website ? – Raphael at Digital Pianism Jun 6 '16 at 21:33
  • 1
    @RaphaelatDigitalPianism Ha! It looks like my friends, the site owners, decided to go ahead with the Shopify conversion that they have been planning for some time. They had some hangups, but I guess they felt that it was cheaper to do the conversion than spend time troubleshooting the Magento issue. – Jordan Rieger Jun 6 '16 at 21:39
  • Ok, see my answer for details I suggest you be careful with that one as it seems like your files got corrupted – Raphael at Digital Pianism Jun 6 '16 at 22:09
  • Are they template version and magento version same? It seems template version is for higher version of magento, this is only an idea because we have not any live url now! – sIiiS Jun 7 '16 at 12:46
0
+100

To me, it clearly sounds like your Magento is badly corrupted.

I can't confirm that because the URL you pasted links to a Shopify website but let me explain.

Regarding the error

That error happens in a very critical file in terms of security, app/code/core/Mage/Payment/Model/Method/Cc.php being the file that handles the Credit Card payment method.

Having an error thrown here in a core file is already a red flag.

On top of that, line 388 does not exist in a native Magento 1.4.0.1 install, you can find the original file here: https://github.com/OpenMage/magento-mirror/blob/1.4.0.1/app/code/core/Mage/Payment/Model/Method/Cc.php

That is a super red flag.

Two possibilities:

  • the original developer(s) modified the core files, which is a very bad practice but I can't see why they would change this file.
  • your install got corrupted by a hacker who used a security breach to modify this file in order to steal Credit Card Information.

Unfortunately, I have a bad feeling that you're in the second case.

That bad feeling comes from the fact that the key that does not exist and that triggers the error is SESSIIID. It looks to me that the corrupted file is trying to steal the session ids to be able to retrieve the credit card details.

One of the most famous Magento vulnerability regarding credit card hijacking uses SESSIID (with two i, there's three in your code) and I'm pretty that's what the hacker wanted to achieve: https://www.byte.nl/blog/widespread-credit-card-hijacking-discovered

Fixing the problem

First, I suggest you run the website against MageReport: https://www.magereport.com/

It will help you finding out the vulnerabilities of your website.

Second, I suggest you roll back all the core files to the original ones.

My personal suggestion would be to use the MageRun plugin developed by AOE to find out which core files have been modified: https://github.com/AOEpeople/mpmd#command-mpmdcorehacks

Finally once you've rolled back the core files to their original state, I suggest you install all the missing patches. You can download them here: https://www.magentocommerce.com/download

  • 1
    This has a lot of good suggestions. I was also suspecting some kind of compromise since the server and cart framework were not updated in a long time and probably had many known vulnerabilities, and the site owners supposedly did no changes recently. Fortunately, the hacker was somewhat inept as he seems to have broken the checkout process rather than stealing anything. Thank you for the details, hopefully they will help someone in the future. – Jordan Rieger Jun 7 '16 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.