Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
4
votes
1answer
584 views

Checkout page loading unauthenticated scripts

I am getting a little shield warning me that my checkout page is trying to load scripts from unauthenticated sources. I am guessing that some file(s) are being loaded via http instead of https, os ...
4
votes
1answer
1k views

Magento Security Report TLSv1.0 Vulnerability

I scanned my site from the New Magento Security Tool available from magento partner portal. The report showed me two Vulnerability issues 1) SSL TLS - Your server supports TLSv1.0. Please update ...
3
votes
4answers
7k views

Security patch SUPEE-1533 error “Patch can't be applied”

I am using Magento CE 1.9 and trying to install security patch SUPEE-1533 but it's giving me this error: Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/...
3
votes
2answers
353 views

Malware Attack On Magento 1.9.2

My website www.antiqworld.com whenever i am trying to open my website automatically redirect on (https://20.unverf.com/?h=230916016_ee5d07ec7ec_98__def_sub__sub_id_2&cnv=1) this url please help ...
3
votes
4answers
118 views

SUPEE 7405 for Magento 2.0

Didn't Magento release SUPEE 7405 Patch for Magento 2.0 and What about the Enterprise edition?
3
votes
3answers
748 views

my magento site hacked again and again [duplicate]

i m so so sad my site hacked 2 times yesterday . i m trying to search a developer for this but all are telling me they can't guarantee about the security i m not sure what to do next. You guys have a ...
3
votes
4answers
1k views

Magento Admin was hacked and show another page

my Magento Admin website was hacked and show me a file manager hacked page with an option to upload file, change permissions, delete, rename, etc like the picture: I tried to change the URL path on ...
3
votes
1answer
2k views

failed while applying security patch SUPEE-6285 [duplicate]

i got error while applying SUPEE-6285 i saw online that i have to apply SUPEE-5994 and i got this error when i applied: $ Sh PATCH_SUPEE-5994.sh Checking if patch can be applied/reverted ...
3
votes
1answer
112 views

Magento Security Scan : some of results are UNKNOWN

I am trying magento's New Magento Security Scan and find out some of Unidentified Results. Status of results are UNKNOWN. How can i completely scan my website.
3
votes
1answer
240 views

how to solve Magento vulnerability issue

Magento website scan report says that it has some issue about security in website.following scan report says about my website vulnerability. vulnerability Name: Php Info File vulnerability Name: Web ...
3
votes
1answer
691 views

Security Patch SUPEE-8788 failing at downloader/Maged/View.php (M1 v1.5.1.0) [duplicate]

On magento v1.5.1.0 patch Supee 8788 fails at downloader/Maged/View.php I downloaded a fresh install of Magento v1.5.1.0, copied the downloader file over and retried but still fails with the same ...
3
votes
1answer
697 views

Magento 2: the phpserver/router.php file

So according to the README, the purpose of this file is to implement the PHP built-in webserver. However, when you open the file, you can see the following from line 35: /** * Caution, this is very ...
3
votes
1answer
150 views

Magento 1.9.0.1 SECURITY ISSUE

In the past few weeks, at least three customers have found that, at checkout, other people's details are showing up in their address book (totally unrelated people...no similarity in name, email or ...
3
votes
1answer
460 views

SUPEE-10266 and SUPEE-10348

I have a client's site that is currently using Mag 1.9.1.0 and need to apply the latest patches. I've applied both 10266 and 10336 (in that order) - all good. However on the description for 10226, it ...
3
votes
3answers
1k views

Magento SUPEE 9697 1.9.2.2 fails at Image.php

I'm attempting to apply patch 9697 (via patch PATCH_SUPEE-9767_CE_1.9.3.0_v1-2017-05-25-09-09-56) to Magento CE 1.9.2.2 however it's failing. The log states: Hunk #5 succeeded at 485 (offset 1 line)....
3
votes
2answers
696 views

How to ignore clickjacking protection for specific route?

Background: I'm integrating an external CMS into Magento, and using a module in Magento to render the preview for the CMS. This happens within an iFrame. In Magento 1.9.0.0 the core/domainpolicy ...
3
votes
1answer
933 views

Dangerous URL blocked on Magento checkout by Kapersky Internet Security Scanner

Iam running a website on Magento 1.9.2.2 and I've spotted that checkout pages of this website are being blocked by Kaspersky Internet security Software. This issue happened to myself and also was ...
3
votes
2answers
853 views

Magento CE 1.9.1.0 Security Patch SUPEE-1533

I am using Magento CE 1.9.1.0 and want to install the security patch SUPEE-1533, but the patch process always run in trouble with the following message: sh ./PATCH_SUPEE-1533_EE_1.13.x_v1-2015-02-10-...
3
votes
2answers
620 views

Why do bots hit report.php and captcha/refresh?

Lately, some of our clients have had some trouble with report mail spam. When tracing this back, report.php and captcha/refresh were hit alot. My guess is that someone is trying to force errors on our ...
3
votes
1answer
2k views

Suddenly started using another logged in user's session - Magento 2

This might be too broad of a question but it is a gigantic security issue and I have no idea where to start debugging this. I was testing some features on my dev server while someone else was logged ...
3
votes
1answer
32 views

Magento 2.1 security: Arbitrary PHP from database fields

I have a basic security question about Magento 2.1 Do any of the modules in a default installation allow the execution of arbitrary PHP code directly from a database field? I'm assuming not, but I ...
3
votes
1answer
165 views

Fixing all target=“_blank” vulnerabilities in a website

https://dev.to/ben/the-targetblank-vulnerability-by-example I've been reading more about this lately and would like to make sure my website(s) are secure. I assume a simple search and replace should ...
3
votes
1answer
2k views

Magento 2.1 - Set customer password in backend

I want it to be possible for the Magento admin to set the passwords for the customers manually in the backend. Is this not possible anymore in Magento 2? I can only find the option to reset the ...
3
votes
1answer
566 views

Magento 1: implementing an autologin link in an email [closed]

So the idea is to have a link in the email that automatically logs a customer in when clicked. I know it is critical especially in terms of security, here's what I've got for now: store the ...
3
votes
1answer
111 views

Magento 1.9 infection - replicating html/php to fake Nike store

I think I have infection with strange code that is replicating in Magento. It creates repeatable html/php plus dirs pointing to fake Nike store. How to get rid of this? I thinks it maybe caused by 1 ...
3
votes
1answer
2k views

Which patches do I need to apply on Magento 1.7.0.2

The site http://fabrizioballiano.net/magento-patches/ listes for Magento 1.7.0.2 the following patches: SUPEE-6482: SUPEE-6482 for CE 1.7.x - 1.8.0.0 (0.01 MB) SUPEE-6285: SUPEE-6285 for CE 1.7.0.0 - ...
3
votes
1answer
306 views

Custom Module: Send email to “Super Admin(s)” when new Admin User Account is created

I'm working on a module with the following objective: Once a new Admin User Account is registered to the system an automated email should be sent to all Admin Users which have the Administrators ...
3
votes
2answers
107 views

Magento patches / leave in directory or delete?

Once a patch has been applied, does the patch file need to be deleted from the httpdocs directory? Or is leaving it there any kind of security risk? Or doesn't it matter?
3
votes
1answer
1k views

SUPEE-5994 Patch Bundle Admin Path Disclosure - Fix Not Working?

I've applied the SUPEE-5994 Patch Bundle to Magento v1.9.0.1 this morning on a development system, and I'm still able to get to the 'hidden' admin login when calling a module directly. Compilation is ...
3
votes
3answers
2k views

Error when trying to apply PATCH_SUPEE-5994_EE_1.14.1.0_v1-2015-05-14-05-05-02.sh

I have just tried to apply PATCH_SUPEE-5994 however below is the message I got. Has anyone else experienced this issue? bash PATCH_SUPEE-5994_EE_1.14.1.0_v1-2015-05-14-05-05-02.sh Checking if patch ...
3
votes
1answer
440 views

Forgotten password page: Show information about registered customer e-mail addresses

When someone goes onto the forgotten password page and enters an email address once they click submit it reloads the log in page even if the email address doesn't exist on the database. Is there a way ...
3
votes
1answer
7k views

Securing add to cart http request

I have a Magento site which integrates with a Javascript based product configurator using reverse proxy on a specific CMS page. The user configures their product and then hits 'Add to Cart' at which ...
3
votes
1answer
38 views

Magento 2: Load patches or update

I'm aware that this probably isn't the first time this question has been answered, but I'm wondering what is the best approach to keeping my magento 2.3.1 install secure: Should I update to 2.3.2 or ...
3
votes
1answer
142 views

Do bound parameters get escaped using the Core/Resource model?

Consider the following example: $connection = Mage::getSingleton('core/resource')->getConnection('core_read'); $email_address = $_GET['email']; $sql = 'SELECT * FROM `foo` WHERE `email_address` = ...
3
votes
2answers
848 views

How to Revert SUPEE-8788 v1 and bash SUPEE-8788 v2

I installed SUPEE-8788 v1, but now I need to revert it and install SUPEE-8788 v2. How can I revert SUPEE-8788 v1 and then install v2? I installed it using SSH bash.
3
votes
2answers
2k views

Security Patch SUPEE 8788 problem

Even I follow the procedure as mentioned in magento. Apply SUPEE-8788 To apply patch SUPEE-8788: Open /app/etc/applied.patches.list in a text editor. Verify SUPEE-8788 is not applied....
3
votes
2answers
509 views

I got hacked - Magento 1.7.0.1 problem when applying patch

I have a store running magento 1.7.0.1 and I got hacked. Someone accessed the admin page - and added a paypal account, probably using an XSS vulnerability. I applied the patches SUPEE-1533, SUPEE-5344,...
3
votes
2answers
1k views

Magento Security Patches showing “Unknown” status in Mage Report

I am keep seeing the patches status is "unknown" in magereport, but the patches are successfully installed in the site. I updated the patch codes in core controllers which are extended local/Mage ...
3
votes
2answers
483 views

Installing SUPEE-6285 for 1.8.1 on 1.8.0.0?

I can not use sh file so I found zip file on magentary.com. The problem is that I found only zip file for 1.8.1, but on my store I have Magento 1.8.0. Is there any difference between those two ...
3
votes
2answers
613 views

Error while Patching Security Patch (SUPEE-6285) - NoItems.phtml (SOLVED)

I'm trying to apply the new patch release today SUPEE-6285 but I get this error : app/design/frontend/base/default/template/checkout/cart/noItems.phtml Hunk #1 FAILED at 31. 1 out of 1 hunk ...
3
votes
1answer
128 views

Magento Notifications Sent To Everyone or Just Me?

I think the patches for the latest security issue with Magento has been installed, but I keep getting messages in the Admin area saying it is critical that I install the patches. Am I getting this ...
3
votes
2answers
1k views

Webgility RCE vulnerability

MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility. While their tool is very helpful in scanning the site and asserting ...
3
votes
1answer
5k views

Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:

I don't know what it's means and how to remove this error. it's showing in my chrome console . but not in firefox console.. (index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
3
votes
2answers
984 views

magento “Invalid login or password.” for frontend customer after some hack [closed]

Initial version: 1.9.0.1 Seems some hack issue suddenly my frontend customers were not able to login with correct password. I did change password from admin for user and tried to login, even that did ...
3
votes
1answer
133 views

Access Denied errors showing for a permission assigned user (created custom module) after installing SUPEE-6285

I installed SUPER-6285 patch on our Mangeto 1.13.1.0. and created a custom module for sales and assign that modules to a user. Showing access denied for that users I applied the below function in my ...
3
votes
1answer
1k views

Other customers address show on checkout - security bug in magento

We have an issue with magento checkout - A customer logged into his account and in checkout page wrong address is shown and the interesting fact is that it is some other customer's address. The same ...
3
votes
0answers
17 views

Magento2 Security: How to best filter GET parameters before they reach Magento?

I want to increase the security of one of our Magento2 installations by filtering GET parameters. It seems that, according to our WAF, especially "filter" parameters are often tried to be exploited; ...
3
votes
1answer
91 views

Magento 2 create ajax request from out of magento

I wanna create Ajax request from empty HTML with jQuery. I do like this $.ajax({ url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****", type: "POST", ...
3
votes
1answer
22 views

Magento Phishing Attempt

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt. ...
3
votes
0answers
475 views

Security Patch SUPEE-10975 - Possible issues? [duplicate]

Magento has released a new security patch for M1, and updates for M1 and M2. What issues should I look out for when upgrading or applying this patch? SUPEE-10975 SUPEE-10975, Magento Commerce 1....