Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
2
votes
1answer
88 views

I've just applied SUPEE-9767 to a Magento 1.6.2.0 site and there is no formkey option to enable. How has this happened and how can I fix it please?

I have applied the SUPEE-9767 patch for the correct version (1.6.2.0) of Magento and in the admin area, I can see the warning at the top of the page, indicating that the patch was successful. However,...
6
votes
4answers
794 views

How does MageReport determine if patch 9767 is installed?

I've applied patch 9767 but for some reason, MageReport is saying it is not installed. Does anyone know the specifics of how MageReport determines if this patch is installed? In my access logs, I can ...
3
votes
1answer
463 views

SUPEE-10266 and SUPEE-10348

I have a client's site that is currently using Mag 1.9.1.0 and need to apply the latest patches. I've applied both 10266 and 10336 (in that order) - all good. However on the description for 10226, it ...
109
votes
23answers
35k views

Security Patch SUPEE-9767 - Possible issues?

A new security patch is out for Magento 1, addressing 16 APPSEC issues: https://magento.com/security/patches/supee-9767 Seven of the vulnerabilities score 8.0 or higher for CVSSv3 Severity, and they ...
2
votes
2answers
327 views

Magento 1.9.2.1 how to prevent core_config_data from getting malicious scripts

I have been scanning the website at Magento Scan and getting the following error: Magento Compromise Injection Your site is compromised with injected JavaScript. (131) The malicious code ...
4
votes
0answers
127 views

Magento 1.9 A strange record found in customer table

I have noticed that there is a weird customer created in my admin, I'm sure this customer wans't created on the frontend because this is a B2B site, and I have removed the front-end registration for ...
50
votes
6answers
31k views

Critical Reminder: Download and install Magento security patches. (FTP with no SSH access)

The Magento security patches look like they are .sh files, how would someone apply these patches without SSH access to their Magento installations? Also, are these patches cumulative? IE: Will they ...
7
votes
2answers
19k views

Admin menu path to: Enable Form Key Validation On Checkout

After installing patch SUPEE-9767 the "Enable Form Key Validation On Checkout" warning appeared and from the link provided in that warning I was able to enable Form Key Validation. But, after having ...
1
vote
1answer
64 views

How do I enable https for my site in Magento 1.9.3.7?

Where would I go in the Admin Panel of Magento 1.9.3.7 to change my site to be https and secure? Thank you.
3
votes
2answers
856 views

How to Revert SUPEE-8788 v1 and bash SUPEE-8788 v2

I installed SUPEE-8788 v1, but now I need to revert it and install SUPEE-8788 v2. How can I revert SUPEE-8788 v1 and then install v2? I installed it using SSH bash.
1
vote
1answer
157 views

Magento 1.3 .ru bots attack! [duplicate]

I'm being attacked by .ru bots on my Magento 1.3. Is there any plugin that works for this old version? Or a way to block them?
3
votes
1answer
2k views

failed while applying security patch SUPEE-6285 [duplicate]

i got error while applying SUPEE-6285 i saw online that i have to apply SUPEE-5994 and i got this error when i applied: $ Sh PATCH_SUPEE-5994.sh Checking if patch can be applied/reverted ...
0
votes
1answer
42 views

Magento 1.7: PCI scan Can't Pass category URL with 'mode' param

Don't know why but the PCI scan do not pass Category URL of Magento and provide a SQL injection with 'mode' param in the below format. /main-category/sub-category/l/price:10-20/category-name.html?dir=...
1
vote
5answers
844 views

How to extract security patch files from sh file

I need to install security patch "PATCH_SUPEE-7405_CE_1.9.2.2_v1-2016-01-20-04-35-33.sh" in magento ver 1.9.2.2 . Is there any way I can extract package of complete patch files from this file.
0
votes
3answers
1k views

Magento security patch 5994/6285 CE problem

I have to work on a "work in progress" magento that someone else started. I have to install some patches magento added. I have no clue / way to know which patch he did install before he left but the ...
12
votes
1answer
5k views

SUPEE-9767 V2 Possible problems and solved Issues

Magento just Release Updated version Of SUPEE-9767 and Magento - CE 1.9.3.4. So MY question is which bugs were solved in V2 and do we need to re apply V2 if we already apply v1. And what are the new ...
1
vote
1answer
30 views

there is ./back directory in my home directory of 1.9.3.4 Do I need it?

there is ./back directory in my public_html directory of 1.9.3.4 Do I need it? Inside there is .back/app/Mage.php which is still old 1.8 version. Besides, the /back directory contains bunch of magento ...
1
vote
1answer
13 views

Is it necessary to do security patches before upgrading Magento?

I am new to Magento. I got a Magento project which I need to upgrade. To do so I read in some tutorials that there are security patches to be performed before upgrading Magento. I am curious if those ...
8
votes
1answer
4k views

Why does Magento POST to its own /app/etc/local.xml?

It seems to be initiated at admin operations, such as catalog save/edit. As seen in the logs. The client IP for the POST is the server's internal IP. 302 2014-08-30T06:43:40+00:00 POST /index.php/...
0
votes
0answers
725 views

Someone is accessing my downloader..What's in /downloader/index.php ? How can I disable it since I never plan to use Magento Connect? [duplicate]

I have a few Magento 1.9 sites running on the same VPS server. I noticed today that the load on the server was unusually high. When I went to investigate, I found out someone was accessing my ...
0
votes
1answer
359 views

Website has backdoor PHP/Small.m how to remove? [closed]

I've one website which is affected by backdoor PHP/Small.m , how can I remove it?
0
votes
1answer
97 views

Add to Compare: is there known exploitation?

Last week, one of my site received a bruteforce attack. When I check log/reports, I see this in my report: a:5:{i:0;s:313:"SQLSTATE[23000]: Integrity constraint violation: 1452 Cannot add or ...
-1
votes
1answer
408 views

Magento ver. 1.9.1.1 There has been an error processing your request, but only on one area [duplicate]

I am new to Magento and not very technical so apologies. The majority of the website seems to be working well, but on one specific product it keeps bringing up the warning "There has been an error ...
1
vote
0answers
248 views

Having issue with Magento 2 security scan. Magento Compromise Injection

I have checked with my all the sites with the bundle and merge js I am getting the same issue for all the sites i.e. Magento Compromise Injection. When I remove bundle and merge js then security scan ...
2
votes
4answers
7k views

Newsletter Spam Subscriber

I got 700 Newsletter subscribers per day for my site, the subscriber name and email id not relevant. What is the possible way to prevent. I think these are all spam accounts.
10
votes
5answers
15k views

Restrict access to admin area by IP

What is the best way to restrict the access to the admin area by IP in Magento? Bear in mind that admin can work either from /admin or index.php/admin
36
votes
11answers
11k views

Security Patch SUPEE-10266 - Possible issues?

A new security patch is out for Magento 1, addressing 13 APPSEC issues https://magento.com/security/patches/supee-10266 What common issues do you have to watch out for when applying this patch? ...
28
votes
6answers
7k views

Magento security patch SUPEE-6482, What is patched?

Today 04.08.2015 there was a new security patch released, some colleagues and I were checking the patch, and is always nice to have some discussion about what changed, also does anyone know what are ...
2
votes
1answer
490 views

Magento 2 websites : BLOCK access from ALL & ALLOW access only from some countries?

There are many options and many articles, but I want some advice for my particular setup from Pros who have more experience than I do. On my VPS I have tree magento websites. All websites have the ...
12
votes
3answers
2k views

Should I upgrade or patch Magento?

I am currently patching Magento with the latest patches and wondered whether it is worth applying the patches or upgrading to the latest version? As far as I can tell the only changes seem to be the ...
1
vote
1answer
81 views

'Clean' magento install 1.9.0.1 (patches installed) spam scripts installed?

I have a couple of magento webshops. And only one magento webshop without any extensions and with all patches installed has the issue that it installs some scripts that send out spam. Some facts: ...
5
votes
1answer
3k views

Is it necessary to override _isAllowed in your Admin controller?

The _isAllowed method is where you, as a Admin Panel programmer, should place your ACL checks. As you can see, by default, this method returns true. That means if you don’t define your own ...
0
votes
2answers
376 views

Get md5 from salted md5 and salt in Magento1 and CS-cart

I am migrating customers from CS-Cart to Magento 1. But I am not getting how can I migrate customers password. As Magento1 uses md5 and also cs-cart uses md5, but cs cart uses it with salt. I know ...
1
vote
0answers
148 views

magento 1.7.0.0 security patch SUPEE-10415 installation issue - Hunk #1 FAILED

Please help me to get rid of this problem and help me to install this SUPEE-10415 security patch on Magento 1.7.0.0.
1
vote
0answers
194 views

Transaction Failed Issue:- Able to redirect to success page automatically(Hacked My Site) [closed]

Yesterday someone made attacked my site, he was able to produce order id without out any Transaction. I have founded why this happened, but don't know how to resolve this critical issue. Here are ...
0
votes
1answer
80 views

My Database may have been affected by Shoplift vulnerability (SUPEE-5344)

I am trying to see all worst case scenario. My one of the site may have been shoplifted. Now, I am in process of quarantine it first then start fresh site with fresh files. However, I do need ...
21
votes
6answers
36k views

What permissions should I give /var and /media?

I understand that magento says to have /var and /media at 700 for folders and 600 for files but when I do this, it breaks certain parts of my site. I am curious to see what permissions most people use ...
3
votes
4answers
4k views

spam email/account @qq.com

Please can you help me with a problem started 1 week ago? every day a customer with chinese name appear on the customer list and our server start to send spam email (fortunately we block automatically ...
8
votes
4answers
2k views

Credit Card Hijack malicious javascript code continuously insert by someone in my site under HTML Head -> Miscellaneous Scripts

Someone continuously inserts Credit Card Hijack malicious javascript into to my site under system->configuration->General->Design->HTML Head->Miscellaneous Scripts. Note: I changed every thing ...
0
votes
1answer
985 views

Javascript Malware attacks

Our shop get repeatedly infected with a "crypto-miner" malware. Its a javascript code that mines cryptocurrency on the client's CPU. Everytime this happens I can find and remove the code in the ...
8
votes
2answers
2k views

How to check applied patches in magento 2

Is there a way in Magento 2 to check the applied patch status? Just like we can check the patch status in Magereport in Magento 1?
1
vote
2answers
410 views

Magento 1.9 Fake customer with address

I have encountered an interesting problem. One of the magento shops I support has a spam problem. A lot of fake customer accounts are created, which I could probably solve easily by adding a honeypot ...
0
votes
0answers
271 views

Magento 2:User Permission via API Rest

I have a multi-store magento 2 installation where the stores are totally independent, from different companies. So, we have an integration with our ERP system in the company. Each user in our system ...
1
vote
2answers
98 views

Security patch supee-8788 - Can it be applied to Magento 2.0.6 community edition?

I would like to know if the supee-8788 security patch can be applied to magento 2.0.6 as I am unable to find any documentation on it relating to magento 2.0.6 ?
0
votes
2answers
259 views

Magento upgrade from 1.9.1.0 to 1.9.3.3 [closed]

Our Magento staging environment has been upgraded from 1.9.1.0 to 1.9.3.3 to meet all security purpose through Magento connect. Once the upgrade process is done through Magento connect, it seems ...
0
votes
2answers
346 views

SUPEE-9767 v2 can't be applied

I'm trying to install SUPEE-9767 but it failed with the following return : patching file app/code/core/Mage/Admin/Model/Session.php Hunk #1 FAILED at 138. 1 out of 1 hunk FAILED -- saving rejects to ...
5
votes
2answers
3k views

Not able to apply security patch SUPEE-6285

We have a Magento website having version 1.9.1.0 (CE). As I got the update from Magento support, to apply security patch on your store to prevent from security threat. We have downloaded the secutiry ...
1
vote
0answers
224 views

How to make hash code verification on payment in magento 2 [closed]

<?php namespace PayUIndia\Payu\Model; use Magento\Sales\Api\Data\TransactionInterface; class Payu extends \Magento\Payment\Model\Method\AbstractMethod { const ...
1
vote
1answer
359 views

How to install Magento security patch for Enterprise Edition (Commerce)?

How can I get Magento patches for Enterprise Edition (now Magento Commerce), I have followed: http://devdocs.magento.com/guides/m1x/other/ht_install-patches.html#get-ee but not getting the exact ...
5
votes
1answer
752 views

New SUPEE-10497 Patch for 1.9.1.1 version possible issue? [duplicate]

A new patch (SUPEE-10497) is available for merchants using Magento Open Source 1.9.1.1. This patch replaces SUPEE-10266 (released September 14, 2017) and SUPEE-10415 (released November 28, 2017). Do ...