Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
4
votes
1answer
277 views

Magento Bug Bounty - New Admin XSS Vulnerability

Is the Magento 1 bug bounty still active? I've found a new obscure XSS vector that will allow attackers to take control of administrator sessions and would like to submit the procedure, yet I don't ...
4
votes
3answers
748 views

Which EE and CE versions need the SUPEE-3762 patch to prevent DOS attack?

It has been recently discovered that the SUPEE-3762 patch, released in August 2014 "accidently" fixed a Denial of Service exploit (see: https://www.byte.nl/blog/denial-of-service-flaw-in-magento) ...
4
votes
1answer
186 views

Reorder link using hash

I'm working on a reorder-module that will allow my customers to: a) Click a link i email b) Click a link in order history What will happend next is that: 1) Delete all items currently in cart 2) ...
4
votes
1answer
2k views

Magento CE 1.8 Password Storage

CE 1.8 inherits from EE 1.13 and lists as a change: “The cryptographic methods used to store passwords were improved to enhance security” As far as I know, earlier versions used APR1 which is a 1000 ...
4
votes
1answer
254 views

Do bound parameters get escaped using the Core/Resource model?

Consider the following example: $connection = Mage::getSingleton('core/resource')->getConnection('core_read'); $email_address = $_GET['email']; $sql = 'SELECT * FROM `foo` WHERE `email_address` = ...
4
votes
1answer
1k views

Spam bots & SQL Injections - How do I stop this?

how do I stop this? Hundreds upon hundreds of these searches.
4
votes
1answer
600 views

Checkout page loading unauthenticated scripts

I am getting a little shield warning me that my checkout page is trying to load scripts from unauthenticated sources. I am guessing that some file(s) are being loaded via http instead of https, os ...
4
votes
1answer
1k views

Magento Security Report TLSv1.0 Vulnerability

I scanned my site from the New Magento Security Tool available from magento partner portal. The report showed me two Vulnerability issues 1) SSL TLS - Your server supports TLSv1.0. Please update ...
4
votes
0answers
482 views

How to implement content security policy in magento 2

I want to know how to implement CSP on Magento 2 with GTM. The site has multiple stores. Tried to google but was unable to find any concrete result. Implimenting a Content Security Policy Magento 1....
4
votes
0answers
96 views

I have Chinese chars in the contents of my session files. Have I been hacked?

I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such ...
4
votes
1answer
221 views

Admin Security, Lockout Attempts, PW Resets

A recent article went out about improving admin security. In it they suggest setting the maximum PW resets and Lockout Time, and for Magento 1.x, this is supposed to live under System > Configuration ...
4
votes
0answers
134 views

Magento 1.9 A strange record found in customer table

I have noticed that there is a weird customer created in my admin, I'm sure this customer wans't created on the frontend because this is a B2B site, and I have removed the front-end registration for ...
3
votes
4answers
7k views

Security patch SUPEE-1533 error “Patch can't be applied”

I am using Magento CE 1.9 and trying to install security patch SUPEE-1533 but it's giving me this error: Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/...
3
votes
4answers
4k views

spam email/account @qq.com

Please can you help me with a problem started 1 week ago? every day a customer with chinese name appear on the customer list and our server start to send spam email (fortunately we block automatically ...
3
votes
4answers
119 views

SUPEE 7405 for Magento 2.0

Didn't Magento release SUPEE 7405 Patch for Magento 2.0 and What about the Enterprise edition?
3
votes
2answers
531 views

Malware Attack On Magento 1.9.2

My website www.antiqworld.com whenever i am trying to open my website automatically redirect on (https://20.unverf.com/?h=230916016_ee5d07ec7ec_98__def_sub__sub_id_2&cnv=1) this url please help ...
3
votes
3answers
847 views

my magento site hacked again and again [duplicate]

i m so so sad my site hacked 2 times yesterday . i m trying to search a developer for this but all are telling me they can't guarantee about the security i m not sure what to do next. You guys have a ...
3
votes
4answers
1k views

Magento Admin was hacked and show another page

my Magento Admin website was hacked and show me a file manager hacked page with an option to upload file, change permissions, delete, rename, etc like the picture: I tried to change the URL path on ...
3
votes
1answer
2k views

failed while applying security patch SUPEE-6285 [duplicate]

i got error while applying SUPEE-6285 i saw online that i have to apply SUPEE-5994 and i got this error when i applied: $ Sh PATCH_SUPEE-5994.sh Checking if patch can be applied/reverted ...
3
votes
1answer
133 views

Magento Security Scan : some of results are UNKNOWN

I am trying magento's New Magento Security Scan and find out some of Unidentified Results. Status of results are UNKNOWN. How can i completely scan my website.
3
votes
1answer
258 views

how to solve Magento vulnerability issue

Magento website scan report says that it has some issue about security in website.following scan report says about my website vulnerability. vulnerability Name: Php Info File vulnerability Name: Web ...
3
votes
1answer
710 views

Security Patch SUPEE-8788 failing at downloader/Maged/View.php (M1 v1.5.1.0) [duplicate]

On magento v1.5.1.0 patch Supee 8788 fails at downloader/Maged/View.php I downloaded a fresh install of Magento v1.5.1.0, copied the downloader file over and retried but still fails with the same ...
3
votes
1answer
866 views

Magento 2: the phpserver/router.php file

So according to the README, the purpose of this file is to implement the PHP built-in webserver. However, when you open the file, you can see the following from line 35: /** * Caution, this is very ...
3
votes
1answer
150 views

Magento 1.9.0.1 SECURITY ISSUE

In the past few weeks, at least three customers have found that, at checkout, other people's details are showing up in their address book (totally unrelated people...no similarity in name, email or ...
3
votes
1answer
468 views

SUPEE-10266 and SUPEE-10348

I have a client's site that is currently using Magento 1.9.1.0 and need to apply the latest patches. I've applied both 10266 and 10336 (in that order) - all good. However on the description for 10266, ...
3
votes
3answers
1k views

Magento SUPEE 9697 1.9.2.2 fails at Image.php

I'm attempting to apply patch 9697 (via patch PATCH_SUPEE-9767_CE_1.9.3.0_v1-2017-05-25-09-09-56) to Magento CE 1.9.2.2 however it's failing. The log states: Hunk #5 succeeded at 485 (offset 1 line)....
3
votes
2answers
820 views

How to ignore clickjacking protection for specific route?

Background: I'm integrating an external CMS into Magento, and using a module in Magento to render the preview for the CMS. This happens within an iFrame. In Magento 1.9.0.0 the core/domainpolicy ...
3
votes
1answer
1k views

Dangerous URL blocked on Magento checkout by Kapersky Internet Security Scanner

Iam running a website on Magento 1.9.2.2 and I've spotted that checkout pages of this website are being blocked by Kaspersky Internet security Software. This issue happened to myself and also was ...
3
votes
2answers
856 views

Magento CE 1.9.1.0 Security Patch SUPEE-1533

I am using Magento CE 1.9.1.0 and want to install the security patch SUPEE-1533, but the patch process always run in trouble with the following message: sh ./PATCH_SUPEE-1533_EE_1.13.x_v1-2015-02-10-...
3
votes
2answers
705 views

Why do bots hit report.php and captcha/refresh?

Lately, some of our clients have had some trouble with report mail spam. When tracing this back, report.php and captcha/refresh were hit alot. My guess is that someone is trying to force errors on our ...
3
votes
1answer
32 views

Magento 2.1 security: Arbitrary PHP from database fields

I have a basic security question about Magento 2.1 Do any of the modules in a default installation allow the execution of arbitrary PHP code directly from a database field? I'm assuming not, but I ...
3
votes
1answer
198 views

Fixing all target=“_blank” vulnerabilities in a website

https://dev.to/ben/the-targetblank-vulnerability-by-example I've been reading more about this lately and would like to make sure my website(s) are secure. I assume a simple search and replace should ...
3
votes
1answer
627 views

Magento 1: implementing an autologin link in an email [closed]

So the idea is to have a link in the email that automatically logs a customer in when clicked. I know it is critical especially in terms of security, here's what I've got for now: store the ...
3
votes
1answer
113 views

Magento 1.9 infection - replicating html/php to fake Nike store

I think I have infection with strange code that is replicating in Magento. It creates repeatable html/php plus dirs pointing to fake Nike store. How to get rid of this? I thinks it maybe caused by 1 ...
3
votes
1answer
3k views

Which patches do I need to apply on Magento 1.7.0.2

The site http://fabrizioballiano.net/magento-patches/ listes for Magento 1.7.0.2 the following patches: SUPEE-6482: SUPEE-6482 for CE 1.7.x - 1.8.0.0 (0.01 MB) SUPEE-6285: SUPEE-6285 for CE 1.7.0.0 - ...
3
votes
1answer
311 views

Custom Module: Send email to “Super Admin(s)” when new Admin User Account is created

I'm working on a module with the following objective: Once a new Admin User Account is registered to the system an automated email should be sent to all Admin Users which have the Administrators ...
3
votes
2answers
108 views

Magento patches / leave in directory or delete?

Once a patch has been applied, does the patch file need to be deleted from the httpdocs directory? Or is leaving it there any kind of security risk? Or doesn't it matter?
3
votes
1answer
1k views

SUPEE-5994 Patch Bundle Admin Path Disclosure - Fix Not Working?

I've applied the SUPEE-5994 Patch Bundle to Magento v1.9.0.1 this morning on a development system, and I'm still able to get to the 'hidden' admin login when calling a module directly. Compilation is ...
3
votes
3answers
2k views

Error when trying to apply PATCH_SUPEE-5994_EE_1.14.1.0_v1-2015-05-14-05-05-02.sh

I have just tried to apply PATCH_SUPEE-5994 however below is the message I got. Has anyone else experienced this issue? bash PATCH_SUPEE-5994_EE_1.14.1.0_v1-2015-05-14-05-05-02.sh Checking if patch ...
3
votes
1answer
448 views

Forgotten password page: Show information about registered customer e-mail addresses

When someone goes onto the forgotten password page and enters an email address once they click submit it reloads the log in page even if the email address doesn't exist on the database. Is there a way ...
3
votes
1answer
7k views

Securing add to cart http request

I have a Magento site which integrates with a Javascript based product configurator using reverse proxy on a specific CMS page. The user configures their product and then hits 'Add to Cart' at which ...
3
votes
1answer
41 views

Magento 2: Load patches or update

I'm aware that this probably isn't the first time this question has been answered, but I'm wondering what is the best approach to keeping my magento 2.3.1 install secure: Should I update to 2.3.2 or ...
3
votes
2answers
870 views

How to Revert SUPEE-8788 v1 and bash SUPEE-8788 v2

I installed SUPEE-8788 v1, but now I need to revert it and install SUPEE-8788 v2. How can I revert SUPEE-8788 v1 and then install v2? I installed it using SSH bash.
3
votes
2answers
2k views

Security Patch SUPEE 8788 problem

Even I follow the procedure as mentioned in magento. Apply SUPEE-8788 To apply patch SUPEE-8788: Open /app/etc/applied.patches.list in a text editor. Verify SUPEE-8788 is not applied. If it is, and ...
3
votes
2answers
540 views

I got hacked - Magento 1.7.0.1 problem when applying patch

I have a store running magento 1.7.0.1 and I got hacked. Someone accessed the admin page - and added a paypal account, probably using an XSS vulnerability. I applied the patches SUPEE-1533, SUPEE-5344,...
3
votes
2answers
1k views

Magento Security Patches showing “Unknown” status in Mage Report

I am keep seeing the patches status is "unknown" in magereport, but the patches are successfully installed in the site. I updated the patch codes in core controllers which are extended local/Mage ...
3
votes
2answers
494 views

Installing SUPEE-6285 for 1.8.1 on 1.8.0.0?

I can not use sh file so I found zip file on magentary.com. The problem is that I found only zip file for 1.8.1, but on my store I have Magento 1.8.0. Is there any difference between those two ...
3
votes
2answers
615 views

Error while Patching Security Patch (SUPEE-6285) - NoItems.phtml (SOLVED)

I'm trying to apply the new patch release today SUPEE-6285 but I get this error : app/design/frontend/base/default/template/checkout/cart/noItems.phtml Hunk #1 FAILED at 31. 1 out of 1 hunk ...
3
votes
1answer
129 views

Magento Notifications Sent To Everyone or Just Me?

I think the patches for the latest security issue with Magento has been installed, but I keep getting messages in the Admin area saying it is critical that I install the patches. Am I getting this ...
3
votes
2answers
1k views

Webgility RCE vulnerability

MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility. While their tool is very helpful in scanning the site and asserting ...

1 2 3
4
5
13