2

I just noticed a few suspicious crash reports on my site for someone accessing the "Catalog Advanced Search" page. However, that link is not exposed anywhere on my site, so someone is accessing a known Magento URL and perhaps attempting some kind of exploit via that URL?

I have all the latest patches, are there known exploits using the Advanced Catalog Search?

I don't know if that URL is used under the covers at all by the Magento implementation, would it be safe for me to do a 403 redirect in my .htaccess for that URL?

Update: Someone suggested it would be useful to know the URLs of the strange requests I'm seeing. I looked at the error reports and there were nine request during the same second that all resulted resulted in the same exception:

SQLSTATE[HY000]: General error: 2006 MySQL server has gone away

Here are the requests...

/shop/catalog/product_compare/add/product/16/uenc/aHR0cDovL3d3dy5waWNrbC1pdC5jb20vc2hvcC9jYXRhbG9nc2VhcmNoL2FkdmFuY2VkL3Jlc3VsdC8_bW9kZT1saXN0/ /shop/catalogsearch/advanced/result?description=1&jars=1&name=..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afetc/passwd&size[]=8&price[from]=1&price[to]=1&short_description=1&sku=1&tax_class_id[]=0&width=1 /shop/catalogsearch/advanced/result?description=1&jars=1&name=sekinchw&size[]=result&price[from]=1&price[to]=1&short_description=1&sku=1&tax_class_id[]=4&width=1 /shop/catalogsearch/advanced/result?description=966869&jars=1&name=seehlqve&size[]=8&price[from]=1&price[to]=1&short_description=1&sku=1&tax_class_id[]=0&width=1 /shop/catalogsearch/advanced/result?description= /shop/catalogsearch/advanced/result?description=1&jars=1&name=cpdqfrdc&size[]=9&price[from]=1&price[to]=1&short_description=1&sku=1&tax_class_id[]=2&width=1 /shop/catalog/product_compare/add/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini/17/uenc/aHR0cDovL3d3dy5waWNrbC1pdC5jb20vc2hvcC9jYXRhbG9nc2VhcmNoL2FkdmFuY2VkL3Jlc3VsdC8_ZGlyPWFzYyZvcmRlcj1uYW1l/ /shop/catalogsearch/advanced/result?description=1&jars=1&name=obioeuth&size[]=8&price[from]=1&price[to]=1&short_description=)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))&sku=1&tax_class_id[]=4&width=1 /shop/catalogsearch/advanced/result?description=1'%22&jars=1&name=seehlqve&size[]=8&price[from]=1&price[to]=1&short_description=1&sku=1&tax_class_id[]=0&width=1

2
  • 1
    Would be interesting to see what the URLs look like. If you don't want to publish them, you could also file a report to [email protected] Commented Aug 2, 2016 at 9:20
  • Added the URLs as requested.
    – MarkE
    Commented Aug 10, 2016 at 23:13

1 Answer 1

1

There two way, we can prevent this url:

redirection

One redirect to catalogsearch/advanced/result and /catalogsearch/advanced/ http://example.com/ to site http://example.com/ ,so that suspicious user or any user cannot access that url.

Add form key:

Or add magento form_key to form and validate that form to post url: Add form key that form by this code <?php echo $this->getBlockHtml('formkey') ?>

1
  • Where can I read more about 'form_key' functionality?
    – MarkE
    Commented Aug 7, 2016 at 19:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.