2

I found a suspicious and possibly dangerous script in the head of a magento 1 site. The script doesn't appear to be declared anywhere. I can't find it in the DB. Where else should I look to see where it's coming from?

1
  • Did you resolve your issue? Oct 15, 2020 at 10:49

1 Answer 1

1

It could be in config or cms block or in cms page

I don't have M1.9 DB, but I guess 1.9 and 2 DB is same for above tables, so try these queries

SELECT * FROM core_config_data WHERE `value` LIKE '%PART OF THE SCRIPT%';

SELECT * FROM cms_block WHERE content LIKE '%PART OF THE SCRIPT%';

SELECT * FROM cms_page WHERE content LIKE  '%PART OF THE SCRIPT%';

Hope you will find the script in your DB

Edited:

I guess the script that is you need to find in above tables is this:

<script type="text/javascript">//<![CDATA[
    var Translator = new Translate({"Please select an option.":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05d0\u05e4\u05e9\u05e8\u05d5\u05ea.","This is a required field.":"\u05e9\u05d3\u05d4 \u05d6\u05d4 \u05d4\u05d9\u05e0\u05d5 \u05d7\u05d5\u05d1\u05d4.","Please enter a valid number in this field.":"\u05d1\u05e9\u05d3\u05d4 \u05d6\u05d4 \u05d9\u05e9 \u05dc\u05d4\u05e7\u05dc\u05d9\u05d3 \u05de\u05e1\u05e4\u05e8 \u05d7\u05d5\u05e7\u05d9.","Please use only letters (a-z), numbers (0-9) or underscore(_) in this field, first character should be a letter.":"\u05d0\u05e0\u05d0 \u05d4\u05e9\u05ea\u05de\u05e9 \u05d1\u05e1\u05e4\u05e8\u05d5\u05ea (0-9), \u05d0\u05d5\u05ea\u05d9\u05d5\u05ea (\u05d0-\u05ea, a-z), \u05d0\u05d5 \u05e7\u05d5 \u05ea\u05d7\u05ea\u05d5\u05df (_) , \u05d1\u05e9\u05d3\u05d4 \u05d6\u05d4. \u05ea\u05d5 \u05e8\u05d0\u05e9\u05d5\u05df \u05e6\u05e8\u05d9\u05da \u05dc\u05d4\u05d9\u05d5\u05ea \u05d0\u05d5\u05ea.","Please enter a valid phone number. For example (123) 456-7890 or 123-456-7890.":"\u05d0\u05e0\u05d0 \u05d4\u05e7\u05dc\u05d3 \u05de\u05e1\u05e4\u05e8 \u05d8\u05dc\u05e4\u05d5\u05df \u05ea\u05e7\u05e0\u05d9, \u05dc\u05d3\u05d5\u05d2\u05de\u05d0: (123) 456-7890 \u05d0\u05d5 123-456-7890","Please enter a valid date.":"\u05d0\u05e0\u05d0 \u05d4\u05db\u05e0\u05e1 \u05ea\u05d0\u05e8\u05d9\u05da \u05d7\u05d5\u05e7\u05d9.","Please enter a valid email address. For example johndoe@domain.com.":"\u05d4\u05e7\u05dc\u05d3 \u05db\u05ea\u05d5\u05d1\u05ea \u05d3\u05d5\u05d0\u05e8 \u05d0\u05dc\u05e7\u05d8\u05e8\u05d5\u05e0\u05d9 \u05ea\u05e7\u05d9\u05e0\u05d4, \u05dc\u05d3\u05d5\u05d2\u05de\u05d0: johndoe@domain.com.","Please make sure your passwords match.":"\u05d0\u05e0\u05d0 \u05d5\u05d3\u05d0 \u05e9\u05e1\u05d9\u05e1\u05de\u05d0\u05d5\u05ea \u05ea\u05d5\u05d0\u05de\u05d5\u05ea.","Please enter a valid URL. For example http:\/\/www.example.com or www.example.com":"\u05d0\u05e0\u05d0 \u05d4\u05e7\u05dc\u05d3 \u05db\u05ea\u05d5\u05d1\u05ea \u05d7\u05d5\u05e7\u05d9\u05ea, \u05dc\u05d3\u05d5\u05d2\u05de\u05d0: http:\/\/www.example.com or www.example.com","Please enter a valid social security number. For example 123-45-6789.":"\u05d0\u05e0\u05d0 \u05d4\u05e7\u05dc\u05d3 \u05de\u05e1\u05e4\u05e8 \u05d1\u05d9\u05d8\u05d5\u05d7 \u05dc\u05d0\u05d5\u05de\u05d9\/\u05ea.\u05d6. \u05ea\u05e7\u05e0\u05d9, \u05dc\u05d3\u05d5\u05d2\u05de\u05d0: 123456789","Please enter a valid zip code. For example 90602 or 90602-1234.":"\u05d0\u05e0\u05d0 \u05e6\u05d9\u05d9\u05df \u05de\u05d9\u05e7\u05d5\u05d3. \u05dc\u05d3\u05d5\u05d2\u05de\u05d0 69020","Please enter a valid zip code.":"\u05d0\u05e0\u05d0 \u05d4\u05db\u05e0\u05e1 \u05de\u05d9\u05e7\u05d5\u05d3 \u05ea\u05e7\u05d9\u05df.","Please use this date format: dd\/mm\/yyyy. For example 17\/03\/2006 for the 17th of March, 2006.":"\u05d0\u05e0\u05d0 \u05d4\u05e9\u05ea\u05de\u05e9 \u05d1\u05e4\u05d5\u05e8\u05de\u05d8 \u05ea\u05d0\u05e8\u05d9\u05da \u05de\u05e1\u05d5\u05d2 dd\/mm\/yyyy, \u05dc\u05d3\u05d5\u05d2\u05de\u05d0: 17\/03\/2006 \u05e2\u05d1\u05d5\u05e8 \u05d4- 17 \u05dc\u05de\u05e8\u05e5, 2006.","Please enter a valid $ amount. For example $100.00.":"\u05d1\u05d1\u05e7\u05e9\u05d4 \u05d4\u05db\u05e0\u05e1 \u05e1\u05db\u05d5\u05dd \u05ea\u05e7\u05d9\u05df \u05dc\u05d3\u05d5\u05d2\u05de\u05d0 $100.00.","Please select one of the above options.":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05d0\u05d7\u05ea \u05d4\u05d0\u05e4\u05e9\u05e8\u05d5\u05d9\u05d5\u05ea \u05dc\u05e2\u05d9\u05dc.","Please select one of the options.":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05d0\u05d7\u05ea \u05d4\u05d0\u05e4\u05e9\u05e8\u05d5\u05d9\u05d5\u05ea.","Please select State\/Province.":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05de\u05d3\u05d9\u05e0\u05d4\/\u05d0\u05d6\u05d5\u05e8.","Please enter a number greater than 0 in this field.":"\u05d1\u05e9\u05d3\u05d4 \u05d6\u05d4 \u05d9\u05e9 \u05dc\u05d4\u05e7\u05dc\u05d9\u05d3 \u05de\u05e1\u05e4\u05e8 \u05d4\u05d2\u05d3\u05d5\u05dc \u05de-0","Please enter a valid credit card number.":"\u05d0\u05e0\u05d0 \u05d4\u05db\u05e0\u05e1 \u05de\u05e1\u05e4\u05e8 \u05db\u05e8\u05d8\u05d9\u05e1 \u05d0\u05e9\u05e8\u05d0\u05d9 \u05ea\u05e7\u05d9\u05df.","Incorrect credit card expiration date.":"\u05ea\u05d5\u05e7\u05e3 \u05d4\u05db\u05e8\u05d8\u05d9\u05e1 \u05e9\u05d2\u05d5\u05d9","Please wait, loading...":"\u05d0\u05e0\u05d0 \u05d4\u05de\u05ea\u05df, \u05d8\u05d5\u05e2\u05df...","Complete":"\u05d4\u05d5\u05e9\u05dc\u05dd","Add Products":"\u05d4\u05d5\u05e1\u05e3 \u05de\u05d5\u05e6\u05e8\u05d9\u05dd","Please specify shipping method.":"\u05d0\u05e0\u05d0 \u05e6\u05d9\u05d9\u05df \u05e9\u05d9\u05d8\u05ea \u05e9\u05d9\u05dc\u05d5\u05d7.","Please specify payment method.":"\u05d0\u05e0\u05d0 \u05e6\u05d9\u05d9\u05df \u05e9\u05d9\u05d8\u05ea \u05ea\u05e9\u05dc\u05d5\u05dd.","Add to Cart":"\u05d4\u05d5\u05e1\u05e3 \u05dc\u05e1\u05dc","In Stock":"\u05d1\u05de\u05dc\u05d0\u05d9","Out of Stock":"\u05dc\u05e4\u05e8\u05d8\u05d9\u05dd \u05d5\u05de\u05d7\u05d9\u05e8\u05d9\u05dd \u05d0\u05e0\u05d0 \u05e4\u05e0\u05d4 \u05dc\u05e9\u05d9\u05e8\u05d5\u05ea \u05dc\u05e7\u05d5\u05d7\u05d5\u05ea","Shipping method has been changed, cancelling payment":"\u05e9\u05d9\u05d8\u05ea \u05de\u05e9\u05dc\u05d5\u05d7 \u05e9\u05d5\u05e0\u05ea\u05d4, \u05de\u05d1\u05d8\u05dc \u05d0\u05ea \u05e9\u05d9\u05d8\u05ea \u05d4\u05ea\u05e9\u05dc\u05d5\u05dd","Please select shipping method first":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05e9\u05d9\u05d8\u05ea \u05de\u05e9\u05dc\u05d5\u05d7","Checkout form validation failed":"\u05d4\u05d5\u05d5\u05dc\u05d9\u05d3\u05e6\u05d9\u05d4 \u05e9\u05dc \u05d4\u05d8\u05d5\u05e4\u05e1 \u05e0\u05db\u05e9\u05dc\u05d4","One of the required fields has been changed, cancelling payment":"\u05d0\u05d7\u05d3 \u05d4\u05d0\u05dc\u05de\u05e0\u05d8\u05d9\u05dd \u05e9\u05dc \u05d4\u05d8\u05d5\u05e4\u05e1 \u05e9\u05d5\u05e0\u05d4, \u05de\u05d1\u05d8\u05dc \u05d0\u05ea \u05e9\u05d9\u05d8\u05ea \u05d4\u05ea\u05e9\u05dc\u05d5\u05dd","Please select billing address":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05db\u05ea\u05d5\u05d1\u05ea \u05d4\u05d7\u05d9\u05d5\u05d1","Please select shipping address":"\u05d0\u05e0\u05d0 \u05d1\u05d7\u05e8 \u05db\u05ea\u05d5\u05d1\u05ea \u05d4\u05de\u05e9\u05dc\u05d5\u05d7","Please accept our Terms and Conditions":"\u05d0\u05e0\u05d0 \u05e7\u05d1\u05dc \u05d5\u05d0\u05e9\u05e8 \u05ea\u05e0\u05d0\u05d9 \u05d4\u05e9\u05d9\u05de\u05d5\u05e9 \u05e9\u05dc \u05d4\u05d0\u05ea\u05e8","In order to proceed please accept our Terms and Conditions":"\u05e2\u05dc\u05d9\u05da \u05dc\u05e7\u05d1\u05dc \u05d0\u05ea \u05ea\u05e0\u05d0\u05d9 \u05d4\u05e9\u05d9\u05de\u05d5\u05e9 \u05d1\u05d0\u05ea\u05e8 \u05e9\u05dc\u05e0\u05d5 \u05e2\u05dc \u05de\u05e0\u05ea \u05dc\u05d4\u05de\u05e9\u05d9\u05da","Please agree with all sales Terms and Conditions":"\u05d0\u05e0\u05d0 \u05e7\u05d1\u05dc \u05d5\u05d0\u05e9\u05e8 \u05ea\u05e0\u05d0\u05d9 \u05d4\u05e9\u05d9\u05de\u05d5\u05e9 \u05e9\u05dc \u05d4\u05d0\u05ea\u05e8","Please make sure all required fields are filled out correctly and shipping method selected":"\u05d0\u05e0\u05d0 \u05d1\u05d3\u05d5\u05e7 \u05d0\u05dd \u05de\u05dc\u05d0\u05ea \u05db\u05dc \u05e9\u05d3\u05d5\u05ea \u05d4\u05d7\u05d5\u05d1\u05d4 (\u05db\u05d2\u05d5\u05df \u05e9\u05dd, \u05d3\u05d5\u05d0\u05e8 \u05d0\u05dc\u05e7\u05d8\u05e8\u05d5\u05e0\u05d9, \u05db\u05ea\u05d5\u05d1\u05ea \u05d4\u05d7\u05d9\u05d5\u05d1, \u05ea\u05e0\u05d0\u05d9 \u05e9\u05d9\u05de\u05d5\u05e9 \u05d5\u05d0\u05d7\u05e8\u05d9\u05dd) \u05d5\u05d1\u05d7\u05e8\u05ea \u05e9\u05d9\u05d8\u05ea \u05de\u05e9\u05dc\u05d5\u05d7.","Form element value has been changed, cancelling payment":"\u05d0\u05d7\u05d3 \u05d4\u05d0\u05dc\u05de\u05e0\u05d8\u05d9\u05dd \u05e9\u05dc \u05d4\u05d8\u05d5\u05e4\u05e1 \u05e9\u05d5\u05e0\u05d4, \u05de\u05d1\u05d8\u05dc \u05d0\u05ea \u05e9\u05d9\u05d8\u05ea \u05d4\u05ea\u05e9\u05dc\u05d5\u05dd"});
    //]]></script>

Find this script and remove it, I think this is the root cause of the suspicious script

13
  • Sadly none of those worked so far. Searching the entire codebase has resulted in nothing either...
    – Reli84
    Oct 15, 2020 at 12:29
  • Also the script appears in inspect element but not in view page source.
    – Reli84
    Oct 15, 2020 at 12:35
  • It means there should be an ajax call, see in browser network, what ajax calls are applying Oct 15, 2020 at 12:38
  • Can you share website URL, let me have a look to the source code Oct 15, 2020 at 17:36
  • papernet.co.il Just get to the checkout page. There's a suspicious script coming from jsassets.net
    – Reli84
    Oct 15, 2020 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.