Yesterday someone made attacked my site, he was able to produce order id without out any Transaction.

I have founded why this happened, but don't know how to resolve this critical issue.

Here are the steps-

  1. Login to Your account.
  2. Buy the item, it will redirect to the payment page.
  3. select any bank with net banking option.
  4. confirm the amount, it will ask for OTP, but don't put any OTP
  5. You all need to found SUCCESS method of site,

once you will get that simply put URL into the browser it will redirect to success page in my case www.mysite.com/checkout/onepage/success/

At admin panel, I am getting Payment Completed message, but I have received Transaction fail mail from my merchant.

Also, I have installed all security patches given by Magento. and my Magento version is-

closed as off-topic by benmarks Jan 15 '16 at 21:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced OR seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – benmarks
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Please Tell me some solution, i am still stuck – Anup Chaudhary Oct 15 '15 at 7:08
  • This seems to be a problem of your payment method rather than a hack. You should contact the extension vendor. – Anna Völkl Jan 15 '16 at 19:58