Yesterday someone made attacked my site, he was able to produce order id without out any Transaction.
I have founded why this happened, but don't know how to resolve this critical issue.
Here are the steps-
- Login to Your account.
- Buy the item, it will redirect to the payment page.
- select any bank with net banking option.
- confirm the amount, it will ask for OTP, but don't put any OTP
- You all need to found SUCCESS method of site,
once you will get that simply put URL into the browser it will redirect to success page in my case www.mysite.com/checkout/onepage/success/
At admin panel, I am getting Payment Completed message, but I have received Transaction fail mail from my merchant.
Also, I have installed all security patches given by Magento. and my Magento version is- 184.108.40.206.