domiosc

Please add social icon for whatsapp

The hosting company say is all secure... and the vulnerable is the website... Index.php modify and copy to random folders: The .ico file: And random files name with 8 letter.php type : Each time the names are different and the routes are random, but the same procedure. after a simple scan I got this recomendations:

I belive this is the sequence, because is repeat various times, I confirm next time inyect files: 65.254.39.186 - - [07/Jun/2020:16:27:13 +0200] GET / HTTP/1.0 302 220 - - 65.254.39.186 - - [07/Jun/2020:16:27:14 +0200] GET / HTTP/1.0 403 12 - - 65.254.39.186 - - [07/Jun/2020:16:27:14 +0200] GET / HTTP/1.0 302 220 - - 65.254.39.186 - - [07/Jun/2020:16:27:15 +0200] GET / HTTP/1.0 403 12 - - 65.254.39.186 - - [07/Jun/2020:16:27:15 +0200] GET /user/ HTTP/1.0 302 229 - - 65.254.39.186 - - [07/Jun/2020:16:27:16 +0200] GET /user/ HTTP/1.0 403 211 - - 65.254.39.186 - - [07/Jun/2020:16:27:16 +0200] GET /user/login.php HTTP/1.0 302 238 - - 65.254.39.186 - - [07/Jun/2020:16:27:17 +0200] GET /user/login.php HTTP/1.0 403 220 - - 65.254.39.186 - - [07/Jun/2020:16:27:17 +0200] GET /user/mail.php/login.php?fooled HTTP/1.0 302 254 - - 65.254.39.186 - - [07/Jun/2020:16:27:18 +0200] GET /user/mail.php/login.php?fooled HTTP/1.0 403 229 - - 65.254.39.186 - - [07/Jun/2020:16:27:18 +0200] GET /user/includes/local/README HTTP/1.0 302 250 - - 65.254.39.186 - - [07/Jun/2020:16:27:19 +0200] GET /user/includes/local/README HTTP/1.0 403 232 - - 65.254.39.186 - - [07/Jun/2020:16:27:19 +0200] GET /images/ HTTP/1.0 302 227 - - 65.254.39.186 - - [07/Jun/2020:16:27:19 +0200] GET /images/ HTTP/1.0 403 209 - - 65.254.39.186 - - [07/Jun/2020:16:27:20 +0200] GET /images/ HTTP/1.0 302 227 - - 65.254.39.186 - - [07/Jun/2020:16:27:20 +0200] GET /images/ HTTP/1.0 403 209 - - 65.254.39.186 - - [07/Jun/2020:16:27:21 +0200] GET /includes/header.php HTTP/1.0 403 221 - - 65.254.39.186 - - [07/Jun/2020:16:27:21 +0200] GET /advanced_search_result.php?keywords=%25%25&search_in_description=1&submit=Search&categories_id=98&inc_subcat=1&manufacturers_id=&pfrom=&pto=1e309&dfrom=&dto= HTTP/1.0 302 413 - - 65.254.39.186 - - [07/Jun/2020:16:27:21 +0200] GET /advanced_search_result.php?keywords=%25%25&search_in_description=1&submit=Search&categories_id=98&inc_subcat=1&manufacturers_id=&pfrom=&pto=1e309&dfrom=&dto= HTTP/1.0 403 228 - - 65.254.39.186 - - [07/Jun/2020:16:27:22 +0200] GET /advanced_search_result.php?keywords=%25%25&search_in_description=1&submit=Search&categories_id=98&inc_subcat=1&manufacturers_id=&pfrom=&pto=1e309&dfrom=&dto= HTTP/1.0 302 413 - - 65.254.39.186 - - [07/Jun/2020:16:27:22 +0200] GET /advanced_search_result.php?keywords=%25%25&search_in_description=1&submit=Search&categories_id=98&inc_subcat=1&manufacturers_id=&pfrom=&pto=1e309&dfrom=&dto= HTTP/1.0 403 228 - - 65.254.39.186 - - [07/Jun/2020:16:27:22 +0200] GET /robots.txt HTTP/1.0 302 230 - - 65.254.39.186 - - [07/Jun/2020:16:27:23 +0200] GET /robots.txt HTTP/1.0 403 212 - - 65.254.39.186 - - [07/Jun/2020:16:27:23 +0200] GET /robots.txt HTTP/1.0 302 230 - - 65.254.39.186 - - [07/Jun/2020:16:27:24 +0200] GET /robots.txt HTTP/1.0 403 212 - - I change my username for user, it seems that the log is cut, but if use this query get with advanced_search_result.php: 1054 - Unknown column 'INF' in 'where clause' select count(distinct p.products_id) as total from products p left join manufacturers m using(manufacturers_id) left join specials s on p.products_id = s.products_id left join tax_rates tr on p.products_tax_class_id = tr.tax_class_id left join zones_to_geo_zones gz on tr.tax_zone_id = gz.geo_zone_id and (gz.zone_country_id is null or gz.zone_country_id = '0' or gz.zone_country_id = '195') and (gz.zone_id is null or gz.zone_id = '0' or gz.zone_id = '3479'), products_description pd, categories c, products_to_categories p2c where p.products_status = '1' and p.products_id = pd.products_id and pd.language_id = '3' and p.products_id = p2c.products_id and p2c.categories_id = c.categories_id and p2c.products_id = p.products_id and p2c.products_id = pd.products_id and (p2c.categories_id = '98') and ((pd.products_seo_keywords LIKE '%%%%' OR pd.products_name like '%%%%' or p.products_model like '%%%%' or m.manufacturers_name like '%%%%' or pd.products_description like '%%%%') ) and (IF(s.status, s.specials_new_products_price, p.products_price) * if(gz.geo_zone_id is null, 1, 1 + (tr.tax_rate / 100) ) <= INF) I don't remember where, I think in phoenix club, someone already commented something about this search ?keywords=%25%25 It may not be this, for the moment I have only blocked the ip, if the same happens from another ip ... I will try to delete advanced_search_result.php

The files are injected, I think there is some vulnerable version 2.2 old file, because this osc is update from 2.2 to phoenix. Surely I will have to do a new installation if I do not find the file is affected, I will be checking the access logs and error logs to see if it gives me any clues.

In my casa is point 2.: created similar files .1489c721.ico and edit index.php or create random php file to link this file, I delete, but recreate so a security bug exist need to fix

Has anyone tried to install in phoenix? It would be nice to update this add-on to phoenix

When upload modules/content/index/cm_i_new_products.php if try to open section modules in admin get error 500. When active slick dependencies this unformat original new product box of index, if un product have 4 lines of text description mount with price, if active module cm_i_new_specials without dependencies show good but not slide. In both case image of product not show centered.

every so often on the control panel show this alert WARNING_SITEMAP_INDEX_XML_EXIST What is this?

Hi Jack, I try to install unsuccessfully. I restore files but site show HTS_TEXT_VIEWING and social icons in catalog and HTS_BOX_HEADING_HEADER_TAGS_SEO menu. Where define name? or How I can full remove

Gtin-14/Ean-14 usually use internally for track packages or pallets and sometimes for complete box of boxes, a box is more normal use a different ean13 or upc12, and individual package use other ean-13 or upc-12 or ean-8. The normal is each manufacturer use one gtin for a specific quantity, but the rules not respect for all, and would use the same for all packaging. @fridgebox the question is control digit with this you can calculate if code is correct and know type of code. For example ean-8 : 88015514, GTIN-8 OK 000088015514, GTIN-12 OK 0000088015514, GTIN-13 OK 00000088015514, GTIN-14 OK https://eancheck.com/ You can view js code algorithm for check and reuse it. I'm with you in that it's confusing, but it seems that it can be handled without having to add or remove zeros to compare. When export with easy populate the code export correctly without adding zeros, so I write ean-13, in admin show with plus zero but in the shop show ean-13 without adding zero, and when export the same. The only problem is admin page or data stored, they can make you doubt for codes start with 0, and not is plan is check every time... 000–019 UPC-A compatible - United States and Canada 020–029 UPC-A compatible - Used to issue restricted circulation numbers within a geographic region[m] 030–039 UPC-A compatible - United States drugs (see United States National Drug Code) 040–049 UPC-A compatible - Used to issue restricted circulation numbers within a geographic region[m] 050–059 UPC-A compatible - GS1 US reserved for future use 060–099 UPC-A compatible - United States and Canada That's why I think not is necessary add zeros for not lost type of code, what's the point of changing an ean8 to gtin14 https://www.gs1.org/sites/default/files/docs/barcodes/GS1_General_Specifications.pdf Reading the 2.1.1.10 GTIN data string, show not is a rule stored with zeros but it is optional The presence or lack of these leading zeroes does not change the GTIN concerned. Note: GTINs may be stored with or without leading zeroes in the same database field, depending on the requirements of the particular application. Note: A GTIN-12 may start with one, two or three leading zeros. These zeroes are meaningful since they are part of the U.P.C. Company prefix, and therefore these must be preserved when storing the GTIN-12 in a database field. For the list of U.P.C. Prefix ranges see section 1.4. https://www.gs1.org/sites/default/files/docs/barcodes/GS1_GTIN_Management_Standard.pdf https://www.gs1.org/standards/id-keys/gtin https://www.gs1.org/1/gtinrules//en/ https://www.gs1.org/sites/default/files/docs/barcodes/Missing-ID-ImpGuide-i1.pdf Note: https://www.gtin.info/ not is official gs1 site, use https://www.gs1.org/ In other improvements I think various gtin for product is need one product not only one. And the relationship with the quantity would not be bad. And set default too. And need MPN field, without needing add extra fields , model actually use for own code, so or use for own code or use for mpn, is limited use at now. In osc 2.2 use module model2 for solution this. Use MPN how key no is a good idea, is easy change some thing, and some manufacturers use spaces or include characters not alphanumerics... gtin/ean/upc are unic, only numbers and have digit control, is unique key 1<->1. Other thing is mask use, How amazon or other little stores, who have indexed pages with the code and you can search in the shop with code, but not show in the source page, this is used for difficult and occult info to competitors and scraping data... Search is easy, but how they get indexed by code not show at the page???

Good work now run, I think button recalculate total no longer needed, because if you change option recalculate correctly. I like to view the print option in checkout confirmation.

Thanks JcMagpie. Not work in phoenix 1.04.1 get error 500 when try to charge Admin/modules_content.php remove and work again, so I can't install it.

Excuse me I reuse your post Yahalimu. Any body can help to redirect old urls -pi- popup img from 2.2 to product page in phoenix now it's resolve with 404 and after several month continuous indexed .

Error 500 again, not work for me

For start we need a minimum of 500-700 € and for finish around 1000€ and one month of work.