Site security & user friendliness: Top E-commerce qualities for 2018

By Carolina It seems security breaches have not just become common, but prevalent throughout society. Between allegations of hacking into voting systems, and then into the most influential social media platforms, digital security has never been more critical. Users and businesses alike must do al...

Magecart Cybergang Targets 0days in Third-Party Magento Extensions

Criminals behind the Magecart gang have shifted tactics, and are now targeting nearly two dozen unpatched vulnerabilities found in third-party plugins used in the Magento e-commerce platform. Previously, the Magecart cybergang had focused on the core of Magento, using attack strategies such as...

It will take more than web pages that load faster to boost holiday conversion

When designing websites to meet peak traffic demands, it is vital to look beyond basic metrics such as page load speed. Providing visual content optimized for both desktop and mobile devices, and combating security threats will help you drive traffic and improve conversion rates during the holida...

Magecart Group Targets Shopper Approved, Customers in Latest Attack

The notorious Magecart threat group has struck again, this time attacking Shopper Approved – a piece of third-party software that provides rating seals for online stores. The attack consequently put payment data from multiple online stores at risk. It’s only the most recent attack for Magecart, a...

A week in security (September 24 – 30)

Last week on Labs was a busy one. We discussed how SMS phishing attacks target the job market, issued a warning for TV Licensing phishes, commented on how Apple confused Safari users with recent changes to how OSX handles browser extensions, and elaborated on holes found in Mojave’s privacy...

How to protect your data from Magecart and other e-commerce attacks

In today's golden age of online shopping, consumers take to the Internet, punch in a few credit card details, and happily receive products at their doorstep, safe in the knowledge that their online vendor is well-known, vetted, and therefore their website has to be secure, right? Dut did you know...

Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection

Exploit Title: Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection Dork: N/A Date: 2018-09-24 Vendor Homepage: https://thephpfactory.com/ Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/reverse-auction-factory/ Version: 4.3.8 Category: Webapps Test...

Joomla! Component Dutch Auction Factory 2.0.2 - filter_order_Dir SQL Injection

Joomla! Component Dutch Auction Factory 2.0.2 - filterorderDir SQL Injection Exploit Title: Joomla! Component Dutch Auction Factory 2.0.2 - 'filterorderDir' SQL Injection Dork: N/A Exploit Author: Ihsan Sencan Date: 2018-09-24 Vendor Homepage: https://thephpfactory.com/ Software Link:...

Joomla! Micro Deal Factory 2.4.0 SQL Injection

Exploit Title: Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection Dork: N/A Date: 2018-09-24 Exploit Author: Ihsan Sencan Vendor Homepage: https://thephpfactory.com/ Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/micro-deal-factory/ Version: 2.4....

Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection

Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection Exploit Title: Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection Dork: N/A Date: 2018-09-24 Vendor Homepage: https://thephpfactory.com/ Software Link:...

Joomla Auction Factory 4.5.5 Component - filter_order SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Auction Factory 4.5.5 - 'filterorder' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://thephpfactory.com/ Software Link:...

Joomla Micro Deal Factory 2.4.0 Component - id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://thephpfactory.com/ Software Link:...

Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection

Exploit Title: Joomla! Component Auction Factory 4.5.5 - 'filterorder' SQL Injection Exploit Author: Ihsan Sencan Dork: N/A Date: 2018-09-24 Vendor Homepage: https://thephpfactory.com/ Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/auction-factory/ Version:...

Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection

Exploit Title: Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection Dork: N/A Date: 2018-09-24 Exploit Author: Ihsan Sencan Vendor Homepage: https://thephpfactory.com/ Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/micro-deal-factory/ Version: 2.4....

Joomla! Component Micro Deal Factory 2.4.0 - id SQL Injection

Joomla! Component Micro Deal Factory 2.4.0 - id SQL Injection Exploit Title: Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection Dork: N/A Date: 2018-09-24 Exploit Author: Ihsan Sencan Vendor Homepage: https://thephpfactory.com/ Software Link:...

Thousands of Breached Websites Turn Up On MagBo Black Market

A newly-discovered underground marketplace has been peddling access to more than 3,000 breached websites, catering to hackers hungry for valuable data and the ability to launch a range of attacks on unsuspecting site visitors. Advertisements for the Russian-speaking marketplace called MagBo were...

MagentoCore Card Skimmer Found on Mass Numbers of E-Commerce Sites

UPDATED A whopping 7,339 and counting individual e-commerce sites have been infested with the MagentoCore.net payment-card skimmer in the last six months, making the malicious script one of the most successful credit-card threats out there. The infections are part of a single effort, all tied bac...

Qibo B2B E-commerce System Stored Cross-site Scripting Vulnerability

Qibo B2B e-commerce system is based on PHP programs and Mysql database-based open source B2B industry portal e-commerce website builder . Qibo B2B e-commerce system stored cross-site scripting vulnerabilities. Attackers can insert malicious js code in the page to obtain user cookies and other...

SQL Injection Vulnerability in Zhejiang Instant E-commerce Co.

Ltd. is a website construction based on the integration of network marketing, bidding ranking, marketing hosting and other integrated e-commerce network marketing company. Ltd. building system there are SQL injection vulnerabilities, attackers can use the vulnerability to obtain sensitive...

Ticketmaster Breach: Just One Part of a Wide-Ranging Campaign

Ticketmaster’s announcement back on June 28 that it was the victim of a payment-card breach ‘turns out to be part of a much larger card-skimming campaign by the threat group Magecart. A whopping 800 e-commerce sites around the world have been targeted by the crooks so far, according to RiskIQ...