I'm a pretty strong developer, but a total newbie to Magento and a friend has asked me to look into his Magento website being hacked.
We are using Magento 1.4.0.1
.
Essentially, when the user finally clicked "Pay" at the end of filling out all their details, the browser would go, as normal, to:
[website]/paypal/standard/redirect/
But then this would ultimately redirect to a completely unknown PayPal account but with the right amount prepopulated to pay.
Looking at the PayPal configuration I was unable to reveal the configuration of the business email in the Website Payments Standard
section of System -> Configuration -> PayPal
as it was asterisked out, and the Website Payments Pro
section was unpopulated.
I tried putting in the correct PayPal email address in the Standard
section, but then the process would just error. So instead I got the API credentials and filled out the Pro
section and then:
- On the first attempt to make a payment the browser was redirected to an entirely new, incorrect and malicious PayPal email address
- On all subsequent attempts, it appears to be going to the correct PayPal account
This worries me that perhaps some other malicious code is being run, and perhaps not on every transaction - although it may well have been some caching issue.
Other than changing all the site passwords, is there anywhere special I should look to check for PayPal hacks? I have inspected \app\code\core\Mage\Paypal\Model\Standard.php
and found nothing suspect, but perhaps I am too new to Magento etc. to know where to really look.
Many thanks!