1

I have been scanning the website at Magento Scan and getting the following error:

Magento Compromise Injection
Your site is compromised with injected JavaScript. (131) The malicious code signature(s) has been found on the page.

In page source I can clearly see a malicious script included in header.

After further research I found that there are entries in core_config_data with path : 'design/head/includes' and the value column has that malicious script.

I have not changed nor uploaded any extensions.

This has happened 3 to 4 times earlier and I am able to track how is this being injected.

When it happened for the first time and for every other times, I have changes database credentials but it didn't helped.

What measures should I take to prevent this?

1

Changing the database credentials only will not help. You may need to change the following:

  • Admin Panel URL path
  • Admin Panel login credentials
  • Check if there are any other admin users created
  • Hosting Panel credentials
  • FTP Login details (if any)
  • SSH credentials

You also need to check whether there are any FTP, SSH users created without your knowledge.

Apart from above, if you are not using SSL (HTTPS) for your website, please ask your hosting provider to install it for you.

Please let me know if you are not sure how to check above details.

  • 1
    Alright will change all of the above and update you. – Wasiq Shahrukh Jul 2 '18 at 8:37
  • 1
    Also check for backdoors, eg webshells under /skin. See mwscan for a Magento malware scanner. – Willem Jul 3 '18 at 19:09
  • 1
    I have just installed Google's Invisible reCaptcha on the website for all forms and since then there are no such issues found. I wonder how can any script enter anything in database from magento's default forms. – Wasiq Shahrukh Jul 16 '18 at 6:24
  • 1
    @Willem I have found some backdoors and other malware codes in skin as well as in some of my code files for blog. I have removed all of them and changed the dir permissions to 755 and for files 644. Before the permissions were 777 for all. – Wasiq Shahrukh Jul 16 '18 at 7:27
  • @WasiqShahrukh, great work. – Mohit Kumar Arora Jul 16 '18 at 7:39
2

Remember that almost all the configuration stores in the table: core_config_data In this case:

SELECT * FROM core_config_data where path like '%design/head/includes%';
  • Sometimes malware is hidden in the cms_blocks and cms_pages tables. To be sure, you should scan your whole SQL dump. – Willem Jul 16 '18 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.