3

I have a store running magento 1.7.0.1 and I got hacked. Someone accessed the admin page - and added a paypal account, probably using an XSS vulnerability. I applied the patches SUPEE-1533, SUPEE-5344, SUPEE-5994, SUPEE-6285 and SUPEE-6482 with no problems (I think), but when I try to install SUPEE-6788 and SUPEE-7405 all the products disappear from the front page. (I have a backup)

I don't have SSH access and for that reason I followed this tutorial.

I was wondering, what patches to install for magento 1.7.0.1 in order to solve the vulnerabilities?

2

First of all, just in case it is not obvious: Patching a hacked site does not solve the hack. You prevent further hacks, which is important, but as the server is already compromised there could be more hacks and backdoors that you are not aware of yet. See also: Probably security issue

Your customer data is at risk! Take the site offline immediately and then start investigating the PHP code and other files.

About the disappearing products: After block types must be added to a whitelist before using them in the CMS. Your theme seems to use custom block types for the home page. Check your home page CMS content and look for {{block type="..."}} directives.

Then see here how to do add them to the white list: APPSEC-1057 How to add variables or blocks to the white list tables

  • Thank you very much, I solved the problem. I had to go on system > permissions > blocks and add the blocks that was hidden. – molunoluda Aug 22 '16 at 16:52
0

scan your site with this link, so it will show what patches are still left.

also you can check this for what patches need to install : link

APPSEC-212 SUPEE-1533 SUPEE-5344 SUPEE-5994 SUPEE-6285 SUPEE-6482 SUPEE-6788 SUPEE-7405 SUPEE-7405 v1.1

  • I'm using it, although it seems not to be updated, it doesn't include the 7405 patch verification and the 6788 doesn't verify. - Now I don't know if the patch is working or the website. – molunoluda Aug 22 '16 at 16:53
  • @molunoluda glad that you found solution..... – Baby in Magento Aug 22 '16 at 17:04
  • 1
    Thank you - A better alternative for security checking: magereport.com – molunoluda Aug 22 '16 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.