Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
1
vote
0answers
103 views

Magento 2.3: How to configure magento CLI commands to use custom names for dangerous redis commands

Environment OS: Ubuntu 18.04 LTS Server: Apache 2.4 Database: MySQL v14.14 distribution 5.7.25 PHP: 7.2 Redis: 5.0.4 Issue Following the digitalocean tutorial referenced ...
1
vote
0answers
27 views

Magento 2 admin backend security

In addition to the extension settings, extension installation loads a lot of unnecessary content. if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
3
votes
1answer
99 views

Magento 2 create ajax request from out of magento

I wanna create Ajax request from empty HTML with jQuery. I do like this $.ajax({ url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****", type: "POST", ...
3
votes
1answer
22 views

Magento Phishing Attempt

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt. ...
1
vote
0answers
70 views

How to enable Two Factor Authentication for Customer Accounts

I would like to enable two-factor-authentication for Customer Accounts, but as per the documentation (https://docs.magento.com/m2/ce/user_guide/magento/extension-install-two-factor-authentication.html)...
3
votes
1answer
484 views

Magento Security Scan reports Malicious Javascript without files

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan. For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
1
vote
2answers
82 views

Why admin added to the site?

Today automatically added two admins to my site? Is my site hacked? What should I do to fix this bug?
0
votes
0answers
23 views

Do I need to update to 2.3.1?

If I have a store set up on 2.3 and I'm having issues getting it to update to 2.3.1 , what are the cons of not updating?
0
votes
1answer
96 views

Want to install SUPEE-11086 patch for magento 1.9.2.0 version

I want to install SUPEE-11086 patch Magento 1.9.2.0 version. Does anyone have an idea about this?
2
votes
1answer
41 views

What does Magento 1's end of life mean for security?

With Magento 1 nearing it's end of life in June 2020, what are the biggest threats when it comes to security?
0
votes
2answers
52 views

HTTPS security is compromised by http://www.mfeuk.co.uk/js/mt/widget/frontend.js

can anyone help with this, I'm not anywhere close to calling myself proficient in magento but can normally track most things by trial and error, I have the problem that on my checkout page I have ...
10
votes
5answers
11k views

How to apply the Magento 2 patches?

I'm using the Magento 2.1.6 and I want to apply the patch CE-MAGETWO-67805.patch. How can I apply the *.patch files?
0
votes
0answers
107 views

which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE

I know how to install a patch file. But which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE. Does anyone know which is the patch I should apply for 1.14.2.0 EE?
0
votes
0answers
54 views

Security problem: newsletter/subscribe has not been whitelisted

i have just move the my magento store to new hosting then im facing this issue In the system.log file im just getting this error , also follows this step but still not did not get any luck. still ...
2
votes
2answers
4k views

Magento 1.9 CE security fixing end of life

I just read all answers from this question: Future Support of Magento 1.9 - Coming Magento 2.0 But I can't find a clear date or an official reference about the end of life date for Magento 1.9. Is ...
14
votes
15answers
8k views

Security Patch SUPEE-10752 - Possible issues?

A new security patch is out for Magento 1, addressing 25 APPSEC issues https://magento.com/security/patches/supee-10752 What common issues do you have to watch out for when applying this patch? ...
0
votes
0answers
18 views

Magento1 website Security patch installation by script then error show

Magento1 website Security patch installation by script and when run url in browser (like http://www.mywebsite.com/applypatch.php)then below error show: ERROR: "/app/etc/" must exist for proper ...
0
votes
1answer
29 views

Magento1 website Security patch installation by script

Magento1 my website i have installing following Security patch: Security patch 10975 Security patch 10415 Security patch 9767 Security patch 8788 Security patch 7405 but i want script in my root ...
4
votes
2answers
345 views

Carding attack on website

I'm getting hit with carding attacks on my website. I've enabled AVS options like so in Paypal. This doesn't seem to be doing enough to stop the attacks. Paypal threatens to shut off my account, ...
1
vote
0answers
124 views

I Have Install this (SUPEE 11086 ) Patch in Magento 1.9.0.4 but Data.php is not working?

I have Install SUPEE 11086 Patch install successfully but not work Properly in backed side? Thanks.
0
votes
1answer
160 views

how to prevent xss attacks and sql injection in magento 2 [closed]

I need to know if there are some configuration from Bo or some patch to prevent those type of attack.
2
votes
2answers
208 views

Failed Magento SUPEE 6482 Security Check (APPSEC-1030) with Version 1.9.3.7 CE

The new Magento Security Scanner reports that there are vulnerabilities on the website and that patch SUPEE 6482 is required. This occurs even when there are no Modules enabled. However, we are ...
1
vote
1answer
629 views

Magento1 SUPEE-11086 Potential Issues? [duplicate]

The Description of the patch SUPEE-11086 is: SUPEE-11086, Magento Commerce 1.14.4.1 and Open Source 1.9.4.1 contain multiple security enhancements that help close remote code execution (RCE), ...
6
votes
1answer
219 views

Critical Vulnerability in Magestore Store Locator extension [closed]

Magento released an announcement about a critical Vulnerability in Magestore Store Locator extension There's been no patch released by the actual vendor - Magestore Does anyone know: What the ...
2
votes
0answers
186 views

How to implement content security policy in magento 2

I want to know how to implement CSP on Magento 2 with GTM. The site has multiple stores. Tried to google but was unable to find any concrete result. Implimenting a Content Security Policy Magento 1....
4
votes
2answers
349 views

Database possibly compromised

I want to know if strangers have accessed the database. If so, I want to find out how they got access to the database. I found a strange trigger in the database (screenshot below).
0
votes
0answers
21 views

Security steps and permission to have for Magento2

I did penetration testing, I got some duplicate theme files in my pub/static/theme, On deleting them something wrong happened with my lib/web the entire folder got empty. Still dont know how this ...
2
votes
1answer
36 views

Security Report - patch 8788

Patch 8788 is available for <= 1.9.2.4. I have 1.9.3.4. How can I fix the issues addressed?
1
vote
0answers
7 views

Creating custom 2FA provider

I'd like to enable the 2FA extension but I'd like to write my own provider (e.g. not Authy or Google Authenticator). Anybody who can point me in the right direction? I have been working with ...
2
votes
1answer
149 views

is this a spam email or real

Message ID : <201812262203.wBQM3RsD009630@web1.gohost.sk> Sent Date : Wed, 26 Dec 2018 22:03:27 +0000 From : magento@gohost.sk Sender MailID : magento@gohost.sk Reply To : magento@gohost.sk To : ...
45
votes
16answers
11k views

Security Patch SUPEE-10570 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What issues should I look out for when upgrading or applying this patch? SUPEE-10570 SUPEE-10570, Magento Commerce 1....
37
votes
9answers
15k views

Security Patch SUPEE-10415 - Possible Issues?

New Magento 1 patch has been released, SUPEE-10415. This patch provides protection against several types of security-related issues Info page: https://magento.com/security/patches/supee-10415 ...
2
votes
2answers
307 views

Contact form hack

I recently faced a problem where, I am receiving emails from an unknown source. Somehow they bypass the validation for email and sending me SQL statement in email fields for example: (SELECT CHAR(113)...
1
vote
2answers
2k views

Magento Payment Methods Not Showing - Shows a CC Form Instead

I have noticed a strange issue recently on the Magento checkout. The same thing occurs whether I am using the default onpage Magento checkout, or if I am using the lotusbreath onepage checkout ...
0
votes
3answers
1k views

Magento 2 Newsletter fake subscriptions

Easily with any email you can subscribe to Magento 2 newsletter. The only available control is to send confirmation email to provided address. If provided email address is not valid Magento ...
-1
votes
1answer
90 views

security patches [duplicate]

I have received some alerts regarding security patches. So can someone guide me on whether to install the security patches or not to install them or what else to do about these security patches?
5
votes
1answer
3k views

Anonymous Scripts found in “Miscellaneous Scripts” section magento admin panel

Recently i had found some scripts inserted into the Miscellaneous Scripts section in admin panel.This code is not inserted by me!! how does it happen? the script i found was given below. can anybody ...
1
vote
3answers
53 views

Is “seolink” a virus?

On my site there is a script after the body tag, both on frontend and adminhtml. I can't find where it is included: It adds links in the header. Has anyone seen this?
1
vote
2answers
128 views

Our Magento account was hacked; files deleted; hosting company is unable to restore

Magento 1.9.1 Porto theme Managed VPS from Hostforweb CentOS 7.x/WHM / Cpanel We got hacked. Files were deleted and our site was and is down. I have a full cPanel backup which I made available to our ...
3
votes
1answer
157 views

Do bound parameters get escaped using the Core/Resource model?

Consider the following example: $connection = Mage::getSingleton('core/resource')->getConnection('core_read'); $email_address = $_GET['email']; $sql = 'SELECT * FROM `foo` WHERE `email_address` = ...
3
votes
1answer
2k views

Suddenly started using another logged in user's session - Magento 2

This might be too broad of a question but it is a gigantic security issue and I have no idea where to start debugging this. I was testing some features on my dev server while someone else was logged ...
1
vote
1answer
144 views

Help! Credit Card Grabber Found on Magento 1.9

I've found a piece of code that contacts a really weird domain with CC info. Can someone confirm it doing something malicious? If so, what should I do without taking down the server? I'm a total ...
0
votes
0answers
23 views

Magento 2.2.2 - Restrict access to Admin and redirect to 404 if unautohrized

I need to allow specific IP's/IP range as authorized users to access Magento admin area and redirect to 404 page not found if an unauthorized IP try to access http://store.com/admin. Could think of ...
0
votes
1answer
176 views

Fixing base_url in database, why? [duplicate]

I have to maintain a Magento 1.9 e-commerce website. I can see that URL is hard coded in database web/secure/base_url web/unsecure/base_url Why this is recommanded ? What could be unsecure to use {...
0
votes
0answers
20 views

ASV scan failing because of Session ID in URL

We're on a Magento 1.9.3.7 and our Aperia ASV scan is failing because of Session ID in URL. One example would be the following https://mystore.com/category.html?SID=rmdfi0m0gibepot9eom7egj384 Payload:...
2
votes
3answers
217 views

Probably security issue

Some months ago i have patched my magento with: SUPEE-1533 SUPEE-5344 SUPEE-6285 SUPEE-5994 SUPEE-6482 SUPEE-6788 and i patched using this instruction https://magentary.com/kb/install-supee-6788-...
12
votes
1answer
573 views

Security reminders keep rolling in… (SUPEE-5344 & SUPEE-1533)

I have several Magento installations, that I manage on behalf of our clients. We already patched the vulnerabilities, but the warnings keep rolling in. We just received the third warning on all sites. ...
1
vote
1answer
33 views

Prevent Magento2 display information on script on homepage

I would like to know how can i stop magento2 to printing information about my plugin and script on homepage.If u analyze my code i have got all these script that contain information about all plugin i ...
0
votes
1answer
192 views

Magento 1 - Patch SUPEE-10415 is not applied

I have tried to apply path SUPEE-10415 to magento 1.9.1.0, but its won't succedeed. Please find the report below. Checking if patch can be applied/reverted successfully. ERROR: Patch can't be ...
0
votes
1answer
248 views

Webgility Security Vulnerability Update [closed]

Webgility provides a module/extension for our Magento customers that enables communication with our core product, Unify. A security vulnerability was discovered in this module on October 16th, 2018 ...