Questions tagged [security]
Denotes security questions on Magento.
602
questions
2
votes
1answer
88 views
I've just applied SUPEE-9767 to a Magento 1.6.2.0 site and there is no formkey option to enable. How has this happened and how can I fix it please?
I have applied the SUPEE-9767 patch for the correct version (1.6.2.0) of Magento and in the admin area, I can see the warning at the top of the page, indicating that the patch was successful.
However,...
6
votes
4answers
794 views
How does MageReport determine if patch 9767 is installed?
I've applied patch 9767 but for some reason, MageReport is saying it is not installed. Does anyone know the specifics of how MageReport determines if this patch is installed?
In my access logs, I can ...
3
votes
1answer
463 views
SUPEE-10266 and SUPEE-10348
I have a client's site that is currently using Mag 1.9.1.0 and need to apply the latest patches. I've applied both 10266 and 10336 (in that order) - all good. However on the description for 10226, it ...
109
votes
23answers
35k views
Security Patch SUPEE-9767 - Possible issues?
A new security patch is out for Magento 1, addressing 16 APPSEC issues: https://magento.com/security/patches/supee-9767
Seven of the vulnerabilities score 8.0 or higher for CVSSv3 Severity, and they ...
2
votes
2answers
327 views
Magento 1.9.2.1 how to prevent core_config_data from getting malicious scripts
I have been scanning the website at Magento Scan and getting the following error:
Magento Compromise Injection
Your site is compromised with injected JavaScript. (131)
The malicious code ...
4
votes
0answers
127 views
Magento 1.9 A strange record found in customer table
I have noticed that there is a weird customer created in my admin,
I'm sure this customer wans't created on the frontend because this is a B2B site, and I have removed the front-end registration for ...
50
votes
6answers
31k views
Critical Reminder: Download and install Magento security patches. (FTP with no SSH access)
The Magento security patches look like they are .sh files, how would someone apply these patches without SSH access to their Magento installations?
Also, are these patches cumulative? IE: Will they ...
Teja Bhagavan Kollepara
3,5574 gold badges23 silver badges53 bronze badges
7
votes
2answers
19k views
Admin menu path to: Enable Form Key Validation On Checkout
After installing patch SUPEE-9767 the "Enable Form Key Validation On Checkout" warning appeared and from the link provided in that warning I was able to enable Form Key Validation.
But, after having ...
1
vote
1answer
64 views
How do I enable https for my site in Magento 1.9.3.7?
Where would I go in the Admin Panel of Magento 1.9.3.7 to change my site to be https and secure?
Thank you.
3
votes
2answers
856 views
How to Revert SUPEE-8788 v1 and bash SUPEE-8788 v2
I installed SUPEE-8788 v1, but now I need to revert it and install SUPEE-8788 v2.
How can I revert SUPEE-8788 v1 and then install v2?
I installed it using SSH bash.
Teja Bhagavan Kollepara
3,5574 gold badges23 silver badges53 bronze badges
1
vote
1answer
157 views
Magento 1.3 .ru bots attack! [duplicate]
I'm being attacked by .ru bots on my Magento 1.3.
Is there any plugin that works for this old version? Or a way to block them?
Teja Bhagavan Kollepara
3,5574 gold badges23 silver badges53 bronze badges
3
votes
1answer
2k views
failed while applying security patch SUPEE-6285 [duplicate]
i got error while applying SUPEE-6285 i saw online that i have to apply SUPEE-5994 and i got this error when i applied:
$ Sh PATCH_SUPEE-5994.sh
Checking if patch can be applied/reverted ...
Teja Bhagavan Kollepara
3,5574 gold badges23 silver badges53 bronze badges
0
votes
1answer
42 views
Magento 1.7: PCI scan Can't Pass category URL with 'mode' param
Don't know why but the PCI scan do not pass Category URL of Magento and provide a SQL injection with 'mode' param in the below format.
/main-category/sub-category/l/price:10-20/category-name.html?dir=...
1
vote
5answers
844 views
How to extract security patch files from sh file
I need to install security patch "PATCH_SUPEE-7405_CE_1.9.2.2_v1-2016-01-20-04-35-33.sh" in magento ver 1.9.2.2 . Is there any way I can extract package of complete patch files from this file.
0
votes
3answers
1k views
Magento security patch 5994/6285 CE problem
I have to work on a "work in progress" magento that someone else started. I have to install some patches magento added. I have no clue / way to know which patch he did install before he left but the ...
Teja Bhagavan Kollepara
3,5574 gold badges23 silver badges53 bronze badges
12
votes
1answer
5k views
SUPEE-9767 V2 Possible problems and solved Issues
Magento just Release Updated version Of SUPEE-9767 and Magento - CE 1.9.3.4.
So MY question is which bugs were solved in V2 and do we need to re apply V2 if we already apply v1.
And what are the new ...
1
vote
1answer
30 views
there is ./back directory in my home directory of 1.9.3.4 Do I need it?
there is ./back directory in my public_html directory of 1.9.3.4 Do I need it?
Inside there is .back/app/Mage.php which is still old 1.8 version. Besides, the /back directory contains bunch of magento ...
1
vote
1answer
13 views
Is it necessary to do security patches before upgrading Magento?
I am new to Magento. I got a Magento project which I need to upgrade. To do so I read in some tutorials that there are security patches to be performed before upgrading Magento.
I am curious if those ...
8
votes
1answer
4k views
Why does Magento POST to its own /app/etc/local.xml?
It seems to be initiated at admin operations, such as catalog save/edit. As seen in the logs. The client IP for the POST is the server's internal IP.
302 2014-08-30T06:43:40+00:00 POST /index.php/...
0
votes
0answers
725 views
Someone is accessing my downloader..What's in /downloader/index.php ? How can I disable it since I never plan to use Magento Connect? [duplicate]
I have a few Magento 1.9 sites running on the same VPS server. I noticed today that the load on the server was unusually high. When I went to investigate, I found out someone was accessing my ...
0
votes
1answer
359 views
Website has backdoor PHP/Small.m how to remove? [closed]
I've one website which is affected by backdoor PHP/Small.m , how can I remove it?
0
votes
1answer
97 views
Add to Compare: is there known exploitation?
Last week, one of my site received a bruteforce attack. When I check log/reports, I see this in my report:
a:5:{i:0;s:313:"SQLSTATE[23000]: Integrity constraint violation: 1452
Cannot add or ...
-1
votes
1answer
408 views
Magento ver. 1.9.1.1 There has been an error processing your request, but only on one area [duplicate]
I am new to Magento and not very technical so apologies. The majority of the website seems to be working well, but on one specific product it keeps bringing up the warning "There has been an error ...
Teja Bhagavan Kollepara
3,5574 gold badges23 silver badges53 bronze badges
1
vote
0answers
248 views
Having issue with Magento 2 security scan. Magento Compromise Injection
I have checked with my all the sites with the bundle and merge js I am getting the same issue for all the sites i.e. Magento Compromise Injection.
When I remove bundle and merge js then security scan ...
2
votes
4answers
7k views
Newsletter Spam Subscriber
I got 700 Newsletter subscribers per day for my site, the subscriber name and email id not relevant. What is the possible way to prevent. I think these are all spam accounts.
10
votes
5answers
15k views
Restrict access to admin area by IP
What is the best way to restrict the access to the admin area by IP in Magento? Bear in mind that admin can work either from /admin or index.php/admin
36
votes
11answers
11k views
Security Patch SUPEE-10266 - Possible issues?
A new security patch is out for Magento 1, addressing 13 APPSEC issues
https://magento.com/security/patches/supee-10266
What common issues do you have to watch out for when applying this patch?
...
28
votes
6answers
7k views
Magento security patch SUPEE-6482, What is patched?
Today 04.08.2015 there was a new security patch released, some colleagues and I were checking the patch, and is always nice to have some discussion about what changed, also does anyone know what are ...
Teja Bhagavan Kollepara
3,5574 gold badges23 silver badges53 bronze badges
2
votes
1answer
490 views
Magento 2 websites : BLOCK access from ALL & ALLOW access only from some countries?
There are many options and many articles, but
I want some advice for my particular setup from Pros who have more experience than I do.
On my VPS I have tree magento websites.
All websites have the ...
Teja Bhagavan Kollepara
3,5574 gold badges23 silver badges53 bronze badges
12
votes
3answers
2k views
Should I upgrade or patch Magento?
I am currently patching Magento with the latest patches and wondered whether it is worth applying the patches or upgrading to the latest version?
As far as I can tell the only changes seem to be the ...
1
vote
1answer
81 views
'Clean' magento install 1.9.0.1 (patches installed) spam scripts installed?
I have a couple of magento webshops. And only one magento webshop without any extensions and with all patches installed has the issue that it installs some scripts that send out spam.
Some facts:
...
Teja Bhagavan Kollepara
3,5574 gold badges23 silver badges53 bronze badges
5
votes
1answer
3k views
Is it necessary to override _isAllowed in your Admin controller?
The _isAllowed method is where you, as a Admin Panel programmer,
should place your ACL checks. As you can see, by default, this method
returns true. That means if you don’t define your own ...
0
votes
2answers
376 views
Get md5 from salted md5 and salt in Magento1 and CS-cart
I am migrating customers from CS-Cart to Magento 1. But I am not getting how can I migrate customers password.
As Magento1 uses md5 and also cs-cart uses md5, but cs cart uses it with salt.
I know ...
1
vote
0answers
148 views
magento 1.7.0.0 security patch SUPEE-10415 installation issue - Hunk #1 FAILED
Please help me to get rid of this problem and help me to install this SUPEE-10415 security patch on Magento 1.7.0.0.
1
vote
0answers
194 views
Transaction Failed Issue:- Able to redirect to success page automatically(Hacked My Site) [closed]
Yesterday someone made attacked my site, he was able to produce order id without out any Transaction.
I have founded why this happened, but don't know how to resolve this critical issue.
Here are ...
Teja Bhagavan Kollepara
3,5574 gold badges23 silver badges53 bronze badges
0
votes
1answer
80 views
My Database may have been affected by Shoplift vulnerability (SUPEE-5344)
I am trying to see all worst case scenario. My one of the site may have been shoplifted.
Now, I am in process of quarantine it first then start fresh site with fresh files.
However, I do need ...
21
votes
6answers
36k views
What permissions should I give /var and /media?
I understand that magento says to have /var and /media at 700 for folders and 600 for files but when I do this, it breaks certain parts of my site. I am curious to see what permissions most people use ...
3
votes
4answers
4k views
spam email/account @qq.com
Please can you help me with a problem started 1 week ago? every day a customer with chinese name appear on the customer list and our server start to send spam email (fortunately we block automatically ...
8
votes
4answers
2k views
Credit Card Hijack malicious javascript code continuously insert by someone in my site under HTML Head -> Miscellaneous Scripts
Someone continuously inserts Credit Card Hijack malicious javascript into to my site under
system->configuration->General->Design->HTML Head->Miscellaneous Scripts.
Note: I changed every thing ...
0
votes
1answer
985 views
Javascript Malware attacks
Our shop get repeatedly infected with a "crypto-miner" malware. Its a javascript code that mines cryptocurrency on the client's CPU.
Everytime this happens I can find and remove the code in the ...
8
votes
2answers
2k views
How to check applied patches in magento 2
Is there a way in Magento 2 to check the applied patch status?
Just like we can check the patch status in Magereport in Magento 1?
1
vote
2answers
410 views
Magento 1.9 Fake customer with address
I have encountered an interesting problem.
One of the magento shops I support has a spam problem.
A lot of fake customer accounts are created, which I could probably solve easily by adding a honeypot ...
0
votes
0answers
271 views
Magento 2:User Permission via API Rest
I have a multi-store magento 2 installation where the stores are totally independent, from different companies.
So, we have an integration with our ERP system in the company. Each user in our system ...
1
vote
2answers
98 views
Security patch supee-8788 - Can it be applied to Magento 2.0.6 community edition?
I would like to know if the supee-8788 security patch can be applied to magento 2.0.6 as I am unable to find any documentation on it relating to magento 2.0.6 ?
0
votes
2answers
259 views
Magento upgrade from 1.9.1.0 to 1.9.3.3 [closed]
Our Magento staging environment has been upgraded from 1.9.1.0 to 1.9.3.3 to meet all security purpose through Magento connect.
Once the upgrade process is done through Magento connect, it seems ...
0
votes
2answers
346 views
SUPEE-9767 v2 can't be applied
I'm trying to install SUPEE-9767 but it failed with the following return :
patching file app/code/core/Mage/Admin/Model/Session.php
Hunk #1 FAILED at 138.
1 out of 1 hunk FAILED -- saving rejects to ...
5
votes
2answers
3k views
Not able to apply security patch SUPEE-6285
We have a Magento website having version 1.9.1.0 (CE). As I got the update from Magento support, to apply security patch on your store to prevent from security threat. We have downloaded the secutiry ...
1
vote
0answers
224 views
How to make hash code verification on payment in magento 2 [closed]
<?php
namespace PayUIndia\Payu\Model;
use Magento\Sales\Api\Data\TransactionInterface;
class Payu extends \Magento\Payment\Model\Method\AbstractMethod {
const ...
1
vote
1answer
359 views
How to install Magento security patch for Enterprise Edition (Commerce)?
How can I get Magento patches for Enterprise Edition (now Magento Commerce), I have followed:
http://devdocs.magento.com/guides/m1x/other/ht_install-patches.html#get-ee
but not getting the exact ...
5
votes
1answer
752 views
New SUPEE-10497 Patch for 1.9.1.1 version possible issue? [duplicate]
A new patch (SUPEE-10497) is available for merchants using Magento Open Source 1.9.1.1. This patch replaces SUPEE-10266 (released September 14, 2017) and SUPEE-10415 (released November 28, 2017).
Do ...
