Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
5
votes
1answer
3k views

Anonymous Scripts found in “Miscellaneous Scripts” section magento admin panel

Recently i had found some scripts inserted into the Miscellaneous Scripts section in admin panel.This code is not inserted by me!! how does it happen? the script i found was given below. can anybody ...
5
votes
3answers
842 views

Error installing security patches on CE 1.7.0.2

SUPEE-1533 installed with no problem. Then attempted to install SUPEE-5345 and three files were patched successfully but the 4th file failed: # sh PATCH_SUPEE-5345_CE_1.7.0.2_v1-2015-02-10-08-11-22....
5
votes
1answer
742 views

New SUPEE-10497 Patch for 1.9.1.1 version possible issue? [duplicate]

A new patch (SUPEE-10497) is available for merchants using Magento Open Source 1.9.1.1. This patch replaces SUPEE-10266 (released September 14, 2017) and SUPEE-10415 (released November 28, 2017). Do ...
5
votes
2answers
1k views

Force log out of backend sessions?

I shared an administrator account with a 3rd party solution provider to debug one of the extensions installed in our store. Now that the problem is fixed I changed the account password. However this ...
5
votes
1answer
407 views

Is my site open to MySQL injection?

As I was updating ready for installing the new patches on a site I have inherited, I found this in my reports: a:5:{i:0;s:313:"SQLSTATE[23000]: Integrity constraint violation: 1452 Cannot add or ...
5
votes
1answer
2k views

Cached images are not loaded in HTTPs

In my custom theme, I'm loading products images using this : <img src="<?php echo $this->helper('catalog/image')->init($_product, 'small_image')->resize(182) ?>" width="182" height=...
5
votes
1answer
3k views

Is it necessary to override _isAllowed in your Admin controller?

The _isAllowed method is where you, as a Admin Panel programmer, should place your ACL checks. As you can see, by default, this method returns true. That means if you don’t define your own ...
5
votes
1answer
717 views

Magento getCollection , SQL injection

I installed an extension for a customer of ours and I'm just learning about SQL and SQL injection, and this extension uses all kind of AJAX calls. However, I checked the code and some of the AJAX ...
5
votes
1answer
714 views

MageReport: “Malicious code found, you are vulnerable” - possible false positive?

I get a warning for one of our sites on magereport.com about the famous Credit Cart Hijack: Credit Card Hijack detected? But there is nothing added to "Miscellaneous HTML" or "Miscellaneous ...
5
votes
1answer
716 views

Error while applying security patch SUPEE-7405 V1

$ sh PATCH_SUPEE-7405_EE_1.13.1.0_v1.sh Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/reverted successfully. patching file app/code/core/Enterprise/...
4
votes
2answers
6k views

SUPEE-5344 - Addresses a potential remote code execution exploit

What will be the major changes in the files after installation of patch SUPEE-5344 for Magento 1.4.2.0? I mean that any particular files permission changes something like that... Please help me for ...
4
votes
3answers
2k views

Shoplift vulnerability if admin panel is hidden?

Among the six installations I have access to there's one that was apparently compromised by Shoplift. This is the only one that has a standard /admin backend url. After patching all of them and ...
4
votes
1answer
548 views

Lifecycle of Magento CE 1.4.1.1

We have a heavily bespoked version of CE 1.4.1.1 and I've looked on the official site but can't seem to find details of any support lifecycle for this version. Can anyone tell me please whether ...
4
votes
4answers
14k views

How to add Access-Control-Allow-Origin to Magento? PHP solution possible?

As a near final step before launching, we have activated SSL/secure pages for checkout etc and are running into the headaches it brings with cross origin requests. We have an ajax cart function that ...
4
votes
3answers
985 views

Can't edit product after install Patch SUPEE-8788

After installation Patch SUPEE-8788 in my Magento 1.7.0.2 I have an error when I try to edit the product: Fatal error: Call to a member function getUploaderConfig() on a non-object in /var/www/html/...
4
votes
3answers
1k views

Possible Magento Hack ? Server load very high, with MySQL server has gone away end

Short story, this is what happens : This guy gets on my site like 5-6 times a day, with a different IP each time. He starts browsing alot of pages,adding products to cart, adding to compare and so ...
4
votes
1answer
5k views

What encryption model does Magento1 use?

I want to know what encryption methods are used by Magento. Is it simple md5 or salted or SHA? Where can I look into it in detail? I looked for code for md5 encryption in Mage_Core_Model_Encryption, ...
4
votes
4answers
2k views

SUPEE PATCH - 9767 error in checkout page [duplicate]

i have applied SUPEE PATCH 9767 into my Magento 1.9 environment. Im using my custom theme for my store, before applying the patch there was no error in the checkout page. But after applying the patch ...
4
votes
2answers
69 views

Mention what is the benefit of applying Connect Patches in Magento?

I have some queries. 1.Mention what is the benefit of applying Connect Patches in Magento? 2.Why all patches are not implemented ? 3.How to check whether it is correctly installed or not ? 4.Is there ...
4
votes
1answer
5k views

Password Requirements Complexity - Magento

I would like to increase password security for customer and admin accounts in Magento. In addition to minimum password length, contain uppercase, lowercase, special characters, and digits. I found ...
4
votes
2answers
874 views

Hackers exploit Magento e-commerce vulnerability

This blog, PC world, claims that the hackers are attacking the e-commerce websites. and I should get updated with the latest patch. Check Point, which found the flaw, reported it to Magento, which ...
4
votes
1answer
3k views

How does magento encrypt credit card numbers?

I have been playing around with the Credit cards (saved) payment option and noticed it encrypts the credit card numbers. What algorithm is it using? What are the specifics? I quite interested to see ...
4
votes
4answers
5k views

Magento 1.9.2.0 SUPEE-8788 v2 Hunk #1 FAILED at 91 after reverting SUPEE-1533 [duplicate]

I reverted SUPEE-1533 as suggested successfully but when I try to patch SUPEE-8788, I get "Hunk #1 FAILED at 91" Please see the log below sh PATCH_SUPEE-8788_CE_1.9.2.0_v2-2016-10-14-09-39-55.sh ...
4
votes
2answers
2k views

How to purge (delete) credit card numbers stored on Magento 1.9.1.0?

We used the 'Saved CC' payment method in our Magento 1.9.1.0 store and now we would like to delete the credit card numbers for security reasons. What is the easiest procedure to delete all credit ...
4
votes
4answers
117 views

Magento CLI options to check Security patch applied or not?

Is there any CLI options to check security patch is applied or not ? How many are pending. I have tried with online tool magereport and many of patch status is unknown. That is why am asking for a ...
4
votes
2answers
288 views

Magento credit card info leak

We are running a magento site 1.8.1.0. For the last couple months, we keep getting customers' complaint about their unauthorized charges on their credit cards. We have applied all the security patches ...
4
votes
2answers
280 views

magento bot blocked my mailware due to guruincsite infection

my magento website got blocked by major browser and antivirus saying infected with mailware "guruincsite infection", 1: i deleted cached 2: deleted unwanted user 3: searched database by using ...
4
votes
2answers
704 views

Disable customer password input field in Magento admin

In Magento Admin > Customers > Manage Customers > Select a customer > Account Information. There is a password field the admin user can input a password for the customer. Due to security reasons, I ...
4
votes
1answer
1k views

Filename of class Varien_Data_Collection_Filesystem getting renamed to Filesystem.php.suspected

We're getting the following error: Magento Fatal error: Class' Varien_Data_Collection_Filesystem' not found Checking the cause of the error, the Filesystem.php file is is renamed to Filesystem.php....
4
votes
2answers
4k views

Patch SUPEE-5344 seems to be SUPEE-5345

I've just downloaded patch SUPEE-5344 and installed it, however the file name and applied.patches.list suggest it is SUPEE-5345, not 5344. OK this may be a typo in the code, perhaps, but checking my ...
4
votes
1answer
862 views

Protect a site from wappalyzer [duplicate]

It's possible to protect a website built with magento to the scan activity of some CMS detector, like Wappalyzer?
4
votes
1answer
362 views

Site still vulnerable to APPSEC-1213 after installing SUPEE-7405

I installed SUPEE-7405 and everything appeared to go smoothly with no errors, however I tested out the exploit described here and to my horror the site still allows me to create an account with an ...
4
votes
2answers
263 views

What can be the security risks if files under var folder are publicly accessible?

I have a Magento live site on which following files are accessible from browser http://www.example.com/var/export/somefile.csv {somefile.csv file name may not be known publicly} http://...
4
votes
1answer
233 views

Still vulnerable after patch installed

We have installed patches to out Magento sites (v1.9, patches 1533 5994 and 6285 (both versions)). However, despite installation reported successful, and after taking note of steps in Applied ...
4
votes
1answer
2k views

How to stop / redirect loading of insecure scripts

I have a google font / stylesheet being loaded over http, how do I change it to https? Its causing error messages to crop up on my secure pages like this: Mixed Content: The page at 'https://www....
4
votes
2answers
197 views

How to know which Patches to Install?

Just downloaded the latest Magento Community Edition v1.9.1.1 and the first thing that popped up when I logged into the admin was that there were important security patches. I installed SUPEE-5994 as ...
4
votes
2answers
271 views

Carding attack on website

I'm getting hit with carding attacks on my website. I've enabled AVS options like so in Paypal. This doesn't seem to be doing enough to stop the attacks. Paypal threatens to shut off my account, ...
4
votes
2answers
318 views

Database possibly compromised

I want to know if strangers have accessed the database. If so, I want to find out how they got access to the database. I found a strange trigger in the database (screenshot below).
4
votes
1answer
3k views

Magento 2: How to get registered customer IP

Anyone know how to determine registered customers IP? I have some spam registrations, so I have to block some IPs. If it's not available from M2 backend then by database table or something?
4
votes
1answer
1k views

Downloading SUPEE 8788 V1 after v2 was released

I have installed the SUPEE 8788 V1 and now I need to revert the patch to install V2. I don't have the v1 sh file and the Magento download page only lets you download V2 now? Where can I download the ...
4
votes
1answer
382 views

Error after installing patch 7405 on Magento 1.4.0.1

The Magento patch 7405 adds a function to app/code/core/Mage/Adminhtml/Helper/Sales.php that is as follows: /** * Escape string preserving links * * @param array|string $data * @param null|array $...
4
votes
3answers
471 views

Can anybody explain me about following code?

Some days back I found this code in one of my application file. I am using git in my server so I can found modified file easily. I checked it but I am not getting what this piece of code does exactly. ...
4
votes
1answer
1k views

Possible arbitrary file inclusion

This is the 3rd time I have seen this on a relatively fresh install of Magento. The only place that the email Hello@example.com exists is in: System > Configuration > Contacts > Email ...
4
votes
2answers
980 views

How to Change the Maximum Number of Customer Login Attempts?

I want to know how to change the customer maximum login attempts in Magento 2. i know how to do it for the admin but can't figure it out for customers.
4
votes
1answer
265 views

Magento Bug Bounty - New Admin XSS Vulnerability

Is the Magento 1 bug bounty still active? I've found a new obscure XSS vector that will allow attackers to take control of administrator sessions and would like to submit the procedure, yet I don't ...
4
votes
3answers
742 views

Which EE and CE versions need the SUPEE-3762 patch to prevent DOS attack?

It has been recently discovered that the SUPEE-3762 patch, released in August 2014 "accidently" fixed a Denial of Service exploit (see: https://www.byte.nl/blog/denial-of-service-flaw-in-magento) ...
4
votes
1answer
174 views

Reorder link using hash

I'm working on a reorder-module that will allow my customers to: a) Click a link i email b) Click a link in order history What will happend next is that: 1) Delete all items currently in cart 2) ...
4
votes
1answer
2k views

Magento CE 1.8 Password Storage

CE 1.8 inherits from EE 1.13 and lists as a change: “The cryptographic methods used to store passwords were improved to enhance security” As far as I know, earlier versions used APR1 which is a 1000 ...
4
votes
1answer
591 views

How to Run Magento 2 using pub/index.php file

How to Run Magento 2 using pub/index.php file. We are going to point the site at pub/index.php for security point of view. Can any one help us on how to configure this and steps to be taken care. ...
4
votes
1answer
1k views

Spam bots & SQL Injections - How do I stop this?

how do I stop this? Hundreds upon hundreds of these searches.