Questions tagged [security]
Denotes security questions on Magento.
1
vote
1answer
30 views
What does Magento 1's end of life mean for security?
With Magento 1 nearing it's end of life in June 2020, what are the biggest threats when it comes to security?
0
votes
0answers
14 views
How to configure ModSecurity on PLESK for Magento 2?
For moment I disabled 3 rules in the security rules, what do you advise ?
0
votes
0answers
13 views
Magento 2.3: How to rename dangerous redis commands whilst maintaining magento functionality?
Environment
OS: Ubuntu 18.04 LTS
Server: Apache 2.4
Database: MySQL v14.14 distribution 5.7.25
PHP: 7.2
Redis: 5.0.4
Issue
Following the digitalocean tutorial referenced within the magento ...
0
votes
1answer
68 views
Want to install SUPEE-11086 patch for magento 1.9.2.0 varsion
But this patch is not available for magento 1.9.2.0.
Anyone have idea about this?
0
votes
1answer
65 views
which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE
I know how to install a patch file. But which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE.
Does anyone know which is the patch I should apply for 1.14.2.0 EE?
0
votes
0answers
23 views
Security problem: newsletter/subscribe has not been whitelisted
i have just move the my magento store to new hosting then im facing this issue
In the system.log file im just getting this error , also follows this step but still not did not get any luck. still ...
0
votes
0answers
14 views
Magento1 website Security patch installation by script then error show
Magento1 website Security patch installation by script and
when run url in browser (like http://www.mywebsite.com/applypatch.php)then below error show:
ERROR: "/app/etc/" must exist for proper ...
0
votes
1answer
23 views
Magento1 website Security patch installation by script
Magento1 my website i have installing following Security patch:
Security patch 10975
Security patch 10415
Security patch 9767
Security patch 8788
Security patch 7405
but i want script in my root ...
3
votes
2answers
118 views
Carding attack on website
I'm getting hit with carding attacks on my website. I've enabled AVS options like so in Paypal.
This doesn't seem to be doing enough to stop the attacks.
Paypal threatens to shut off my account, ...
1
vote
0answers
109 views
I Have Install this (SUPEE 11086 ) Patch in Magento 1.9.0.4 but Data.php is not working?
I have Install SUPEE 11086 Patch install successfully but not work Properly in backed side?
Thanks.
1
vote
1answer
440 views
Magento1 SUPEE-11086 Potential Issues? [duplicate]
The Description of the patch SUPEE-11086 is:
SUPEE-11086, Magento Commerce 1.14.4.1 and Open Source 1.9.4.1 contain
multiple security enhancements that help close remote code execution
(RCE), ...
20
votes
16answers
3k views
Security Patch SUPEE-11086 - Possible issues?
Magento has released a new security patch for M1, and updates for M1 and M2.
These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible."
...
6
votes
1answer
128 views
Critical Vulnerability in Magestore Store Locator extension [closed]
Magento released an announcement about a critical Vulnerability in Magestore Store Locator extension
There's been no patch released by the actual vendor - Magestore
Does anyone know:
What the ...
1
vote
0answers
45 views
How to implement content security policy in magento 2
I want to know how to implement CSP on Magento 2 with GTM.
The site has multiple stores. Tried to google but was unable to find any concrete result.
Implimenting a Content Security Policy Magento 1....
0
votes
1answer
66 views
how to prevent xss attacks and sql injection in magento 2 [closed]
I need to know if there are some configuration from Bo or some patch to prevent those type of attack.
0
votes
0answers
17 views
Security steps and permission to have for Magento2
I did penetration testing, I got some duplicate theme files in my pub/static/theme, On deleting them something wrong happened with my lib/web the entire folder got empty. Still dont know how this ...
2
votes
1answer
28 views
Security Report - patch 8788
Patch 8788 is available for <= 1.9.2.4.
I have 1.9.3.4.
How can I fix the issues addressed?
4
votes
2answers
228 views
Database possibly compromised
I want to know if strangers have accessed the database.
If so, I want to find out how they got access to the database.
I found a strange trigger in the database (screenshot below).
1
vote
0answers
26 views
How to enable Two Factor Authentication for Customer Accounts
I would like to enable two-factor-authentication for Customer Accounts, but as per the documentation (https://docs.magento.com/m2/ce/user_guide/magento/extension-install-two-factor-authentication.html)...
1
vote
0answers
7 views
Creating custom 2FA provider
I'd like to enable the 2FA extension but I'd like to write my own provider (e.g. not Authy or Google Authenticator).
Anybody who can point me in the right direction? I have been working with ...
3
votes
1answer
82 views
Do bound parameters get escaped using the Core/Resource model?
Consider the following example:
$connection = Mage::getSingleton('core/resource')->getConnection('core_read');
$email_address = $_GET['email'];
$sql = 'SELECT * FROM `foo` WHERE `email_address` = ...
1
vote
1answer
79 views
Help! Credit Card Grabber Found on Magento 1.9
I've found a piece of code that contacts a really weird domain with CC info.
Can someone confirm it doing something malicious?
If so, what should I do without taking down the server? I'm a total ...
0
votes
0answers
14 views
Magento 2.2.2 - Restrict access to Admin and redirect to 404 if unautohrized
I need to allow specific IP's/IP range as authorized users to access Magento admin area and redirect to 404 page not found if an unauthorized IP try to access
http://store.com/admin. Could think of ...
2
votes
1answer
134 views
is this a spam email or real
Message ID : <201812262203.wBQM3RsD009630@web1.gohost.sk>
Sent Date : Wed, 26 Dec 2018 22:03:27 +0000
From : magento@gohost.sk
Sender MailID : magento@gohost.sk
Reply To : magento@gohost.sk
To : ...
0
votes
0answers
17 views
ASV scan failing because of Session ID in URL
We're on a Magento 1.9.3.7 and our Aperia ASV scan is failing because of Session ID in URL.
One example would be the following https://mystore.com/category.html?SID=rmdfi0m0gibepot9eom7egj384
Payload:...
0
votes
1answer
101 views
Magento 1 - Patch SUPEE-10415 is not applied
I have tried to apply path SUPEE-10415 to magento 1.9.1.0, but its won't succedeed.
Please find the report below.
Checking if patch can be applied/reverted successfully.
ERROR: Patch can't be ...
1
vote
1answer
29 views
Prevent Magento2 display information on script on homepage
I would like to know how can i stop magento2 to printing information about my plugin and script on homepage.If u analyze my code i have got all these script that contain information about all plugin i ...
0
votes
1answer
174 views
Webgility Security Vulnerability Update [closed]
Webgility provides a module/extension for our Magento customers that enables communication with our core product, Unify. A security vulnerability was discovered in this module on October 16th, 2018 ...
3
votes
0answers
458 views
Security Patch SUPEE-10975 - Possible issues? [duplicate]
Magento has released a new security patch for M1, and updates for M1 and M2.
What issues should I look out for when upgrading or applying this patch?
SUPEE-10975
SUPEE-10975, Magento Commerce 1....
1
vote
2answers
188 views
Magento compromised, second “PayPal Express Checkout” option added sending payment to unauthorized recipient
I had an order come in that wasn't followed by a PayPal payment, so I asked the customer if he had paid, and he sent me a screenshot of the receipt which shows the payment going to "Trust Website ...
1
vote
1answer
280 views
Problem with patch SUPEE-10888 on Magento 1.9.0.1
Problem with patch PATCH_SUPEE-10888_CE_v1.9.0.1_v1-2018-09-19-03-00-53.sh on Magento 1.9.0.1, with all previous patches installed:
Checking if patch can be applied/reverted successfully...
ERROR: ...
1
vote
0answers
33 views
New security threat to Magento caused by it using jQuery-File-Upload?
Magento 2 uses the Blueimp jQuery File Upload Plugin v5.16.4 which has recently been identified at posing a security risk to web applications which use it.
Is this an issue for Magento and should ...
15
votes
13answers
5k views
SUPEE-10975 Potential Issues
SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support?
So far these ...
0
votes
0answers
16 views
Why does /soap not follow site X-FRAME header?
After a pen test a low impact security flaw was reported saying that X-FRAME-OPTIONS were not being set. Which was odd as following the devdocs recommendation (https://devdocs.magento.com/guides/v2.2/...
3
votes
2answers
509 views
Webgility RCE vulnerability
MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility.
While their tool is very helpful in scanning the site and asserting ...
1
vote
1answer
273 views
How to remove malicious code from the each files of the website magento 2?
I am seeing some malicious code in the website. Each files of every folder is affected by this code. How to remove this code from the website?
Is any script to remove or replace this malicious code?
...
1
vote
2answers
95 views
Magento 1.9.3.2 - Exception printing is disabled by default for security reasons
I have just moved a Magento install from one server to another and now when I try to access the frontend I get the "Exception printing is disabled by default for security reasons" error.
I have ...
2
votes
1answer
52 views
How to stop fake reviews and fake signups on Magento 1 and Magento 2?
We have 2 websites one is on Magento 1 and the second is on Magento 2 , In both websites we get fake reviews and fake signups everyday. Someone told me to add captcha which will not let bots or ...
1
vote
2answers
111 views
I found some malicious code in all index.php of magento 1.9.2
Need help to stop malicious code in all index.php file
Once I remove malicious code from index.php then again its apperar in index.php files
malicious code like --
$swvJgN7="xQC+...
1
vote
2answers
111 views
Our Magento account was hacked; files deleted; hosting company is unable to restore
Magento 1.9.1
Porto theme
Managed VPS from Hostforweb
CentOS 7.x/WHM / Cpanel
We got hacked. Files were deleted and our site was and is down. I have a full cPanel backup which I made available to our ...
1
vote
1answer
128 views
Magento2 Two factor authentication for Frontend
Do you guys know where to purchase or download M2 2FA ext for FRONTEND (or both frontend and admin)
0
votes
0answers
33 views
How to secure my website magento 2
I want to secure my website from script injection and other Security failures so is there patch or somthing that i have to do or upload to do so.
Also i want advice from you concerning sécurity ...
2
votes
1answer
56 views
How to create a nonce / secure hash in Magento 2?
I want a simple link to activate a customer out of an email that gets sent to the admin on registration.
I am using this module: https://github.com/enrico69/magento2-customer-activation for the ...
3
votes
1answer
68 views
Can anyone have any idea of security patch file of SUPEE-9652 V2?
As i'm unable to find the SUPEE-9652 V2 version related security patch, because of these I'm unable to run another patch i.e, SUPEE-10570, can anyone provide me the solutions For Magento 1.9.x. ...
1
vote
0answers
20 views
Access orders page with wget [duplicate]
people. My question may be simple but I can't find an answer. I want to be able to get the page source of my orders with a command. I plan something like
wget -user myUserName -password myPassword ...
2
votes
0answers
192 views
Magento Security Scan reports Malicious Javascript without files
I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan.
For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
0
votes
0answers
251 views
Magento known issue while upgrade from 1.9.3.9 to 1.9.3.10? [duplicate]
I just got notification that 1.9.3.10 is released with SUPEE-10888 curious to know if someone has already update it and faced any issue?
19
votes
16answers
6k views
Security Patch SUPEE-10888 - Possible issues?
SUPEE-10888 is a new security patch for Magento 1 which addresses 12 security issues.
https://magento.com/security/patches/supee-10888
SUPEE-10888, Magento Commerce 1.14.3.10 and Open Source 1.9.3....
1
vote
0answers
68 views
Magento 2 CE + CyberSource Checkout [closed]
I'm trying to set up a 2.2.5 store with CyberSource v3, however, I keep receiving below error.
You are not authorized to view this page. The transaction has not been
processed. If the problem ...
1
vote
1answer
49 views
Magento 1.9 with no security patches got hacked. How to install the security patches without Magento Connect?
Magento 1.9.1
Porto theme
Our Magento got hacked. The hacker deleted our user accounts and created one for themselves with the user ID of shopmanager1. I had to connect to the database, delete his ...
