3

I have a store running magento 1.7.0.1 and I got hacked. Someone accessed the admin page - and added a paypal account, probably using an XSS vulnerability. I applied the patches SUPEE-1533, SUPEE-5344, SUPEE-5994, SUPEE-6285 and SUPEE-6482 with no problems (I think), but when I try to install SUPEE-6788 and SUPEE-7405 all the products disappear from the front page. (I have a backup)

I don't have SSH access and for that reason I followed this tutorial.

I was wondering, what patches to install for magento 1.7.0.1 in order to solve the vulnerabilities?

Improve this question

2 Answers 2

Reset to default
2

First of all, just in case it is not obvious: Patching a hacked site does not solve the hack. You prevent further hacks, which is important, but as the server is already compromised there could be more hacks and backdoors that you are not aware of yet. See also: Probably security issue

Your customer data is at risk! Take the site offline immediately and then start investigating the PHP code and other files.

About the disappearing products: After block types must be added to a whitelist before using them in the CMS. Your theme seems to use custom block types for the home page. Check your home page CMS content and look for {{block type="..."}} directives.

Then see here how to do add them to the white list: APPSEC-1057 How to add variables or blocks to the white list tables

Improve this answer
1
  • Thank you very much, I solved the problem. I had to go on system > permissions > blocks and add the blocks that was hidden.
    – molunoluda
    Aug 22, 2016 at 16:52
0

scan your site with this link, so it will show what patches are still left.

also you can check this for what patches need to install : link

APPSEC-212 SUPEE-1533 SUPEE-5344 SUPEE-5994 SUPEE-6285 SUPEE-6482 SUPEE-6788 SUPEE-7405 SUPEE-7405 v1.1

Improve this answer
3
  • I'm using it, although it seems not to be updated, it doesn't include the 7405 patch verification and the 6788 doesn't verify. - Now I don't know if the patch is working or the website.
    – molunoluda
    Aug 22, 2016 at 16:53
  • @molunoluda glad that you found solution.....
    – Baby in Magento
    Aug 22, 2016 at 17:04
  • 1
    Thank you - A better alternative for security checking: magereport.com
    – molunoluda
    Aug 22, 2016 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.