This morning, looking at paypel settings we realised that the paypal email address has been changed! How is it possible? has some one got access to admin panel? Whta are possible way to do that? could he get access to the database? Please help :(


I have seen same issue in my client's portals, Many Magento sites get hacked and hacker is able to change the paypal details and can create admin user as well.

When I was debugging it, I found many vulnerable files in media, js folder.

Update the Magento version, change all the passwords and look for the unwanted files in media and js folder. These are executable files which give whole access to hacker.

  • what type of file should I look for in paths you mentioned? executable file? – Zinat Jul 21 '16 at 8:46
  • I have deleted the files so not sure with the extension but that was not php but file was being executed from browser, You can check any incorrect media url, which may redirect you to that file, check .htaccess entry as well in all top folders, Compare js folder list with backup or standard magento. – Aman Srivastava Jul 21 '16 at 8:53

Did you leave the admin url as default? It will be big problem with secure if someone can change Paypal email address! Also please check again all installed extension to make sure you've not installed scam bot.

  • Fortunately no, it is not default one...scam bot? – Zinat Jul 21 '16 at 8:45
  • I never got same problem. But you should do: 1. Change admin url to special path. 2. Rename folder Downloable if not need to avoid any attack through Magento connect. (easy attack on 1.7) 3. Unactive any confused modules. 4. Download source code into localhost then scan with Avast(free anti virus software) , you may found some strange php script or js script which attack your store. – Minh Jul 21 '16 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.