OpenCart Community

Posted: **Sun Aug 25, 2013 8:21 pm**

We are running Version 1.4.9.3. If you see http://www.littlegemstoys.com.au/ you will see coding

"#32f02e# if(empty($hmdx)) {$hmdx = "";echo $hmdx;} #/32f02e# #32f02e# if(empty($hmdx)) {$hmdx = "";echo $hmdx;} #/32f02e#" at the top and at the bottom of page "Fatal error: Call to a member function get() on a non-object in /home2/lili1031/public_html/index.php on line 91"

We are unable to login via the Admin page. http://www.littlegemstoys.com.au/admin/

Code: Select all

The header has the following "#32f02e# if(empty($hmdx)) {$hmdx = "";echo $hmdx;} #/32f02e# #32f02e# if(empty($hmdx)) {$hmdx = "";echo $hmdx;} #/32f02e# #32f02e# if(empty($hmdx)) {$hmdx = "";echo $hmdx;} #/32f02e# #32f02e# if(empty($hmdx)) {$hmdx = "";echo $hmdx;} #/32f02e#" and the footer "Fatal error: Call to a member function get() on a non-object in /home2/lili1031/public_html/admin/index.php on line 71"

I thought it may have been hacked, but files look okay. The only other thing is maybe the host site has upgraded their server?

Can anyone point me in the write direction to fix this?

Thanks

Andrew

Posted: **Sun Aug 25, 2013 10:35 pm**

Your code is compromised aka you're hacked.

Check you file permissions and restore your files from a backup.

Posted: **Sun Aug 25, 2013 11:38 pm**

Back up database first. You cannot merely overwrite everything with a known good backup. For example, anything odd in /download/ will still be there, and any malicious .php or other files having their own names will not be overwritten. Find and delete those, look at timestamps. You can wipe 'er out and replace 'er, or you can overwrite what belongs and destroy what does not belong. For example, this actual bad file with a weird name, executable YbTVjBRr.php, will not be overwritten and must be deleted. If you see a seemingly benign executable default.php among OC files, delete it; not benign, start looking for and deleting other oddments. Lacking a backup but having your database, you still have the option of using a genuine OC .zip for your version. Check your permissions, directories 755, files 644, and ensure that if you correct them such as from 777, they stay corrected. See PM.

Nothing in that is caused by the server. For example, "#32f02e#" stripped of the right-hand # is a color code. It was, as i2Paq immediately and succinctly indicated, hacked.

Posted: **Mon Aug 26, 2013 10:45 am**

See also this for some of the extent of hacking: http://forum.opencart.com/viewtopic.php?f=20&t=98644 all the way through to http://forum.opencart.com/viewtopic.php ... 60#p431729

OpenCart Community

Error on web site "#32f02e# if(empty($hmdx)) {$hmdx = "";ec"

Error on web site "#32f02e# if(empty($hmdx)) {$hmdx = "";ec"

Re: Error on web site "#32f02e# if(empty($hmdx)) {$hmdx = ""

Re: Error on web site "#32f02e# if(empty($hmdx)) {$hmdx = ""

Re: Error on web site "#32f02e# if(empty($hmdx)) {$hmdx = ""