Post by cjfranca » Wed Jun 09, 2021 2:39 am

Hello guys

I have customer need to fix a problem in your store. Admin access show for any user. Inside admin panel have only admin user default, but if I try access with my email show ok.

<?php
// Version
define('VERSION', '3.0.3.7');
....
>
How to fix this? ;D

New member

Posts

Joined
Tue Jun 30, 2020 5:05 am
Location - São Paulo- BR

Post by straightlight » Wed Jun 09, 2021 6:48 pm

cjfranca wrote:
Wed Jun 09, 2021 2:39 am
Hello guys

I have customer need to fix a problem in your store. Admin access show for any user. Inside admin panel have only admin user default, but if I try access with my email show ok.

<?php
// Version
define('VERSION', '3.0.3.7');
....
>
How to fix this? ;D
Vague. More info needed.

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester


Legendary Member

Posts

Joined
Mon Nov 14, 2011 11:38 pm
Location - Canada, ON

Post by cjfranca » Wed Jun 09, 2021 10:59 pm

straightlight wrote:
Wed Jun 09, 2021 6:48 pm
cjfranca wrote:
Wed Jun 09, 2021 2:39 am
Hello guys

I have customer need to fix a problem in your store. Admin access show for any user. Inside admin panel have only admin user default, but if I try access with my email show ok.

<?php
// Version
define('VERSION', '3.0.3.7');
....
>
How to fix this? ;D
Vague. More info needed.
I try to acess admin environment type user: admin and password admin free acess . But if I type ney email exemplo: claudia and password 123456 I access too.
I need block to acesso whe user haven´t registred.

New member

Posts

Joined
Tue Jun 30, 2020 5:05 am
Location - São Paulo- BR

Post by straightlight » Wed Jun 09, 2021 11:05 pm

cjfranca wrote:
Wed Jun 09, 2021 10:59 pm
straightlight wrote:
Wed Jun 09, 2021 6:48 pm
cjfranca wrote:
Wed Jun 09, 2021 2:39 am
Hello guys

I have customer need to fix a problem in your store. Admin access show for any user. Inside admin panel have only admin user default, but if I try access with my email show ok.

<?php
// Version
define('VERSION', '3.0.3.7');
....
>
How to fix this? ;D
Vague. More info needed.
I try to acess admin environment type user: admin and password admin free acess . But if I type ney email exemplo: claudia and password 123456 I access too.
I need block to acesso whe user haven´t registred.
If the user account is not registered, no valid / active user account should be able to login. If an account is still able to login without being registered, then you're looking at SPAM accounts where an extension from the Marketplace would be needed to block those login attempts.

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester


Legendary Member

Posts

Joined
Mon Nov 14, 2011 11:38 pm
Location - Canada, ON

Post by cjfranca » Wed Jun 09, 2021 11:21 pm

straightlight wrote:
Wed Jun 09, 2021 11:05 pm
cjfranca wrote:
Wed Jun 09, 2021 10:59 pm
straightlight wrote:
Wed Jun 09, 2021 6:48 pm


Vague. More info needed.
I try to acess admin environment type user: admin and password admin free acess . But if I type ney email exemplo: claudia and password 123456 I access too.
I need block to acesso whe user haven´t registred.
If the user account is not registered, no valid / active user account should be able to login. If an account is still able to login without being registered, then you're looking at SPAM accounts where an extension from the Marketplace would be needed to block those login attempts.
Ok, But why to do this?

Do you can show me how I can to know , why this happen ?

New member

Posts

Joined
Tue Jun 30, 2020 5:05 am
Location - São Paulo- BR

Post by EvolveWebHosting » Wed Jun 09, 2021 11:23 pm

cjfranca wrote:
Wed Jun 09, 2021 11:21 pm
straightlight wrote:
Wed Jun 09, 2021 11:05 pm
cjfranca wrote:
Wed Jun 09, 2021 10:59 pm


I try to acess admin environment type user: admin and password admin free acess . But if I type ney email exemplo: claudia and password 123456 I access too.
I need block to acesso whe user haven´t registred.
If the user account is not registered, no valid / active user account should be able to login. If an account is still able to login without being registered, then you're looking at SPAM accounts where an extension from the Marketplace would be needed to block those login attempts.
Ok, But why to do this?

Do you can show me how I can to know , why this happen ?
Look in your user database table for one. Do these users exist? Are your files uploaded to the server with the proper file permissions? Have you tried a .htaccess block for the admin folder to limit access to certain IP addresses only? Something out of the norm is definitely happening with your install. It's not default behavior of Opencart.

Opencart Hosting Plans, Domain Registration, Microsoft and Google Email and More
Visit our website for great deals and most importantly, fast and friendly support - www.evolvewebhost.com


User avatar
Active Member

Posts

Joined
Fri Mar 27, 2015 11:13 pm
Location - Denver, Colorado, USA

Post by straightlight » Wed Jun 09, 2021 11:27 pm

cjfranca wrote:
Wed Jun 09, 2021 11:21 pm
straightlight wrote:
Wed Jun 09, 2021 11:05 pm
cjfranca wrote:
Wed Jun 09, 2021 10:59 pm


I try to acess admin environment type user: admin and password admin free acess . But if I type ney email exemplo: claudia and password 123456 I access too.
I need block to acesso whe user haven´t registred.
If the user account is not registered, no valid / active user account should be able to login. If an account is still able to login without being registered, then you're looking at SPAM accounts where an extension from the Marketplace would be needed to block those login attempts.
Ok, But why to do this?

Do you can show me how I can to know , why this happen ?
You could always create a new service request in the Commercial Support section of the forum to have this issue investigated as a custom job.

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester


Legendary Member

Posts

Joined
Mon Nov 14, 2011 11:38 pm
Location - Canada, ON

Post by JNeuhoff » Thu Jun 10, 2021 12:06 am

In a standard OC 3.0.3.7 only pre-defined users have access to the admin backend, not just any customer.
It looks like your website might be compromised. Compare all OC files with the original ones to see whether anything suspicious has been added.

Export/Import Tool * SpamBot Buster * Unused Images Manager * Instant Option Price Calculator * Number Option * Google Tag Manager * Survey Plus * OpenTwig


User avatar
Guru Member

Posts

Joined
Wed Dec 05, 2007 3:38 am


Post by cjfranca » Thu Jun 10, 2021 3:54 am

EvolveWebHosting wrote:
Wed Jun 09, 2021 11:23 pm
cjfranca wrote:
Wed Jun 09, 2021 11:21 pm
straightlight wrote:
Wed Jun 09, 2021 11:05 pm


If the user account is not registered, no valid / active user account should be able to login. If an account is still able to login without being registered, then you're looking at SPAM accounts where an extension from the Marketplace would be needed to block those login attempts.
Ok, But why to do this?

Do you can show me how I can to know , why this happen ?
Look in your user database table for one. Do these users exist? Are your files uploaded to the server with the proper file permissions? Have you tried a .htaccess block for the admin folder to limit access to certain IP addresses only? Something out of the norm is definitely happening with your install. It's not default behavior of Opencart.
Thank you for your attentions
I will talk with my team, and go back speak here about solutions or not, and make a post in commercial area.

New member

Posts

Joined
Tue Jun 30, 2020 5:05 am
Location - São Paulo- BR

Post by Fierros_2 » Mon Jun 21, 2021 6:00 pm

Thank you for this information helping me a lot.

Newbie

Posts

Joined
Mon Jun 21, 2021 5:57 pm

Post by datisnetwork » Thu Jul 01, 2021 11:48 pm

i had this problem thanks work for me

Newbie

Posts

Joined
Thu Jul 01, 2021 11:37 pm

Who is online

Users browsing this forum: No registered users and 78 guests