Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
4
votes
1answer
182 views

Do bound parameters get escaped using the Core/Resource model?

Consider the following example: $connection = Mage::getSingleton('core/resource')->getConnection('core_read'); $email_address = $_GET['email']; $sql = 'SELECT * FROM `foo` WHERE `email_address` = ...
4
votes
1answer
624 views

How to Run Magento 2 using pub/index.php file

How to Run Magento 2 using pub/index.php file. We are going to point the site at pub/index.php for security point of view. Can any one help us on how to configure this and steps to be taken care. ...
4
votes
1answer
1k views

Spam bots & SQL Injections - How do I stop this?

how do I stop this? Hundreds upon hundreds of these searches.
4
votes
1answer
589 views

Checkout page loading unauthenticated scripts

I am getting a little shield warning me that my checkout page is trying to load scripts from unauthenticated sources. I am guessing that some file(s) are being loaded via http instead of https, os ...
4
votes
1answer
1k views

Magento Security Report TLSv1.0 Vulnerability

I scanned my site from the New Magento Security Tool available from magento partner portal. The report showed me two Vulnerability issues 1) SSL TLS - Your server supports TLSv1.0. Please update ...
4
votes
0answers
92 views

I have Chinese chars in the contents of my session files. Have I been hacked?

I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such ...
4
votes
1answer
192 views

Admin Security, Lockout Attempts, PW Resets

A recent article went out about improving admin security. In it they suggest setting the maximum PW resets and Lockout Time, and for Magento 1.x, this is supposed to live under System > Configuration ...
4
votes
0answers
127 views

Magento 1.9 A strange record found in customer table

I have noticed that there is a weird customer created in my admin, I'm sure this customer wans't created on the frontend because this is a B2B site, and I have removed the front-end registration for ...
3
votes
4answers
7k views

Security patch SUPEE-1533 error “Patch can't be applied”

I am using Magento CE 1.9 and trying to install security patch SUPEE-1533 but it's giving me this error: Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/...
3
votes
4answers
4k views

spam email/account @qq.com

Please can you help me with a problem started 1 week ago? every day a customer with chinese name appear on the customer list and our server start to send spam email (fortunately we block automatically ...
3
votes
2answers
398 views

Malware Attack On Magento 1.9.2

My website www.antiqworld.com whenever i am trying to open my website automatically redirect on (https://20.unverf.com/?h=230916016_ee5d07ec7ec_98__def_sub__sub_id_2&cnv=1) this url please help ...
3
votes
4answers
118 views

SUPEE 7405 for Magento 2.0

Didn't Magento release SUPEE 7405 Patch for Magento 2.0 and What about the Enterprise edition?
3
votes
3answers
788 views

my magento site hacked again and again [duplicate]

i m so so sad my site hacked 2 times yesterday . i m trying to search a developer for this but all are telling me they can't guarantee about the security i m not sure what to do next. You guys have a ...
3
votes
4answers
1k views

Magento Admin was hacked and show another page

my Magento Admin website was hacked and show me a file manager hacked page with an option to upload file, change permissions, delete, rename, etc like the picture: I tried to change the URL path on ...
3
votes
1answer
2k views

failed while applying security patch SUPEE-6285 [duplicate]

i got error while applying SUPEE-6285 i saw online that i have to apply SUPEE-5994 and i got this error when i applied: $ Sh PATCH_SUPEE-5994.sh Checking if patch can be applied/reverted ...
3
votes
1answer
116 views

Magento Security Scan : some of results are UNKNOWN

I am trying magento's New Magento Security Scan and find out some of Unidentified Results. Status of results are UNKNOWN. How can i completely scan my website.
3
votes
1answer
246 views

how to solve Magento vulnerability issue

Magento website scan report says that it has some issue about security in website.following scan report says about my website vulnerability. vulnerability Name: Php Info File vulnerability Name: Web ...
3
votes
1answer
696 views

Security Patch SUPEE-8788 failing at downloader/Maged/View.php (M1 v1.5.1.0) [duplicate]

On magento v1.5.1.0 patch Supee 8788 fails at downloader/Maged/View.php I downloaded a fresh install of Magento v1.5.1.0, copied the downloader file over and retried but still fails with the same ...
3
votes
1answer
737 views

Magento 2: the phpserver/router.php file

So according to the README, the purpose of this file is to implement the PHP built-in webserver. However, when you open the file, you can see the following from line 35: /** * Caution, this is very ...
3
votes
1answer
150 views

Magento 1.9.0.1 SECURITY ISSUE

In the past few weeks, at least three customers have found that, at checkout, other people's details are showing up in their address book (totally unrelated people...no similarity in name, email or ...
3
votes
1answer
463 views

SUPEE-10266 and SUPEE-10348

I have a client's site that is currently using Mag 1.9.1.0 and need to apply the latest patches. I've applied both 10266 and 10336 (in that order) - all good. However on the description for 10226, it ...
3
votes
3answers
1k views

Magento SUPEE 9697 1.9.2.2 fails at Image.php

I'm attempting to apply patch 9697 (via patch PATCH_SUPEE-9767_CE_1.9.3.0_v1-2017-05-25-09-09-56) to Magento CE 1.9.2.2 however it's failing. The log states: Hunk #5 succeeded at 485 (offset 1 line)....
3
votes
2answers
739 views

How to ignore clickjacking protection for specific route?

Background: I'm integrating an external CMS into Magento, and using a module in Magento to render the preview for the CMS. This happens within an iFrame. In Magento 1.9.0.0 the core/domainpolicy ...
3
votes
1answer
967 views

Dangerous URL blocked on Magento checkout by Kapersky Internet Security Scanner

Iam running a website on Magento 1.9.2.2 and I've spotted that checkout pages of this website are being blocked by Kaspersky Internet security Software. This issue happened to myself and also was ...
3
votes
2answers
853 views

Magento CE 1.9.1.0 Security Patch SUPEE-1533

I am using Magento CE 1.9.1.0 and want to install the security patch SUPEE-1533, but the patch process always run in trouble with the following message: sh ./PATCH_SUPEE-1533_EE_1.13.x_v1-2015-02-10-...
3
votes
2answers
654 views

Why do bots hit report.php and captcha/refresh?

Lately, some of our clients have had some trouble with report mail spam. When tracing this back, report.php and captcha/refresh were hit alot. My guess is that someone is trying to force errors on our ...
3
votes
1answer
2k views

Suddenly started using another logged in user's session - Magento 2

This might be too broad of a question but it is a gigantic security issue and I have no idea where to start debugging this. I was testing some features on my dev server while someone else was logged ...
3
votes
1answer
32 views

Magento 2.1 security: Arbitrary PHP from database fields

I have a basic security question about Magento 2.1 Do any of the modules in a default installation allow the execution of arbitrary PHP code directly from a database field? I'm assuming not, but I ...
3
votes
1answer
175 views

Fixing all target=“_blank” vulnerabilities in a website

https://dev.to/ben/the-targetblank-vulnerability-by-example I've been reading more about this lately and would like to make sure my website(s) are secure. I assume a simple search and replace should ...
3
votes
1answer
585 views

Magento 1: implementing an autologin link in an email [closed]

So the idea is to have a link in the email that automatically logs a customer in when clicked. I know it is critical especially in terms of security, here's what I've got for now: store the ...
3
votes
1answer
111 views

Magento 1.9 infection - replicating html/php to fake Nike store

I think I have infection with strange code that is replicating in Magento. It creates repeatable html/php plus dirs pointing to fake Nike store. How to get rid of this? I thinks it maybe caused by 1 ...
3
votes
1answer
3k views

Which patches do I need to apply on Magento 1.7.0.2

The site http://fabrizioballiano.net/magento-patches/ listes for Magento 1.7.0.2 the following patches: SUPEE-6482: SUPEE-6482 for CE 1.7.x - 1.8.0.0 (0.01 MB) SUPEE-6285: SUPEE-6285 for CE 1.7.0.0 - ...
3
votes
1answer
308 views

Custom Module: Send email to “Super Admin(s)” when new Admin User Account is created

I'm working on a module with the following objective: Once a new Admin User Account is registered to the system an automated email should be sent to all Admin Users which have the Administrators ...
3
votes
2answers
107 views

Magento patches / leave in directory or delete?

Once a patch has been applied, does the patch file need to be deleted from the httpdocs directory? Or is leaving it there any kind of security risk? Or doesn't it matter?
3
votes
1answer
1k views

SUPEE-5994 Patch Bundle Admin Path Disclosure - Fix Not Working?

I've applied the SUPEE-5994 Patch Bundle to Magento v1.9.0.1 this morning on a development system, and I'm still able to get to the 'hidden' admin login when calling a module directly. Compilation is ...
3
votes
3answers
2k views

Error when trying to apply PATCH_SUPEE-5994_EE_1.14.1.0_v1-2015-05-14-05-05-02.sh

I have just tried to apply PATCH_SUPEE-5994 however below is the message I got. Has anyone else experienced this issue? bash PATCH_SUPEE-5994_EE_1.14.1.0_v1-2015-05-14-05-05-02.sh Checking if patch ...
3
votes
1answer
443 views

Forgotten password page: Show information about registered customer e-mail addresses

When someone goes onto the forgotten password page and enters an email address once they click submit it reloads the log in page even if the email address doesn't exist on the database. Is there a way ...
3
votes
1answer
7k views

Securing add to cart http request

I have a Magento site which integrates with a Javascript based product configurator using reverse proxy on a specific CMS page. The user configures their product and then hits 'Add to Cart' at which ...
3
votes
1answer
38 views

Magento 2: Load patches or update

I'm aware that this probably isn't the first time this question has been answered, but I'm wondering what is the best approach to keeping my magento 2.3.1 install secure: Should I update to 2.3.2 or ...
3
votes
2answers
856 views

How to Revert SUPEE-8788 v1 and bash SUPEE-8788 v2

I installed SUPEE-8788 v1, but now I need to revert it and install SUPEE-8788 v2. How can I revert SUPEE-8788 v1 and then install v2? I installed it using SSH bash.
3
votes
2answers
2k views

Security Patch SUPEE 8788 problem

Even I follow the procedure as mentioned in magento. Apply SUPEE-8788 To apply patch SUPEE-8788: Open /app/etc/applied.patches.list in a text editor. Verify SUPEE-8788 is not applied....
3
votes
2answers
517 views

I got hacked - Magento 1.7.0.1 problem when applying patch

I have a store running magento 1.7.0.1 and I got hacked. Someone accessed the admin page - and added a paypal account, probably using an XSS vulnerability. I applied the patches SUPEE-1533, SUPEE-5344,...
3
votes
2answers
1k views

Magento Security Patches showing “Unknown” status in Mage Report

I am keep seeing the patches status is "unknown" in magereport, but the patches are successfully installed in the site. I updated the patch codes in core controllers which are extended local/Mage ...
3
votes
2answers
486 views

Installing SUPEE-6285 for 1.8.1 on 1.8.0.0?

I can not use sh file so I found zip file on magentary.com. The problem is that I found only zip file for 1.8.1, but on my store I have Magento 1.8.0. Is there any difference between those two ...
3
votes
2answers
614 views

Error while Patching Security Patch (SUPEE-6285) - NoItems.phtml (SOLVED)

I'm trying to apply the new patch release today SUPEE-6285 but I get this error : app/design/frontend/base/default/template/checkout/cart/noItems.phtml Hunk #1 FAILED at 31. 1 out of 1 hunk ...
3
votes
1answer
128 views

Magento Notifications Sent To Everyone or Just Me?

I think the patches for the latest security issue with Magento has been installed, but I keep getting messages in the Admin area saying it is critical that I install the patches. Am I getting this ...
3
votes
2answers
1k views

Webgility RCE vulnerability

MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility. While their tool is very helpful in scanning the site and asserting ...
3
votes
1answer
5k views

Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:

I don't know what it's means and how to remove this error. it's showing in my chrome console . but not in firefox console.. (index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
3
votes
2answers
1k views

magento “Invalid login or password.” for frontend customer after some hack [closed]

Initial version: 1.9.0.1 Seems some hack issue suddenly my frontend customers were not able to login with correct password. I did change password from admin for user and tried to login, even that did ...
3
votes
1answer
133 views

Access Denied errors showing for a permission assigned user (created custom module) after installing SUPEE-6285

I installed SUPER-6285 patch on our Mangeto 1.13.1.0. and created a custom module for sales and assign that modules to a user. Showing access denied for that users I applied the below function in my ...