Magento store SQL Injection Vulnerability and Security

We have all heard and witnessed that Magento comes with some predefined tools which are intended to secure your store from SQL injections. Yet the security researchers have found some vulnerabilities, which can potentially cause harm.

What is the nature of the Attack?

The vulnerability consists of compromising a chain of liability which allows malicious injections and unauthenticated attacker to execute random PHP/SQL codes on E-commerce websites. In layman’s terms, this allows the attacker to bypass all your security mechanism, then get the access to your store and the whole database. It lets the attacker then create a new admin account in your existing one, or lets them access and steal critical information like credit card etc. There are many other harmful things that SQL injections can cause to your Ecommerce business and your store’s customers. What is of more concern is the fact that this attack is not limited to any specific plugin or theme. It is present at the core Magento and it ends up affecting any default installation of community and enterprise editions both.

What to do to be Protected?

The Magento team issued a patch for fixing this problem, there was a lot of hype about code flaws discovered which were leading towards the exploitation. The security research community considered and viewed it as a very important concern and developers were given time to create a patch while users were given time to do the application of it. The details were then made public to help the other users and to make sure that the Magento community widely was aware of what was happening.

Unfortunately, after conducting further research and doing a detailed study researcher revealed that many web companies still have a lot of security concerns. There are nearly about 100,000 stores which happen to be still vulnerable. There have also been incidents of attacks which are used wildly against websites that have not implemented the patch till now. What we advise is being a Magento store owner, you need to apply the relevant patch right away.

You can easily find and apply this designed patch SUPEE-5344 which is released by Magento and can be found on this link: https://www.magentocommerce.com/download

Final Thought

We advise that, unauthenticated user or any attacker who can exploit the vulnerability and run the arbitrary PHP/SQL code on your Magento store to have full access to your store’s complete database and also any sensitive customer information needs to be taken care of immediately! Because unless and until your Magento website is patched, it is sadly vulnerable and can be exploited by offenders.

If you are unable or don’t know how to implement the patch, then leave a comment below and we will be happy to guide you through the whole process ☺