No patch SUPEE-6482 was found to be implemented on the Content Management Software of this website.
Actually online customers should be warned against visiting such insecure Magento webshop sites.
Re:
https://gwillem.gitlab.io/2018/08/30/magentocore.net_skimmer_most_aggressive_to_date/Sloppiness in updating, upgrading and patching should be punished through a general shown hall of shame
for those website admins and hosters that do a lousy and insecure job and put themselves and others at risk.
Alas we are not used to castigate them in public.
See:
https://www.magereport.com/scan/?s=https://quick.qsl-webshop.com/Where we stumbled upon it:
https://www.shodan.io/host/195.160.161.138
Identifiant client
-195.160.161.138
Paragon Data GmbH
Added on 2018-08-31 02:39:57 GMT
GermanyGermany
Technologies: PHPMagento
Details
SSL Certificate
Issued By:
|- Common Name: COMODO RSA Organization Validation Secure Server CA
|- Organization: COMODO CA Limited
Issued To:
|- Common Name: -*.qsl-webshop.com
|- Organization: Meyer Quick Service Logistics GmbH & Co. KG
Supported SSL Versions
TLSv1, TLSv1.1, TLSv1.2
HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Fri, 31 Aug 2018 02:39:57 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/7.1.17-1+0~20180505045738.17+stretch~1.gbpde69c6
Set-Cookie: store=qu_fr_fr; expires=Sa...
More insecurity established here:
https://webhint.io/scanner/9b909295-e1b5-46ee-9bd8-e1e1366a9da8 with 97 security errors detected
F-grade security status and recommendations:
https://observatory.mozilla.org/analyze/quick.qsl-webshop.comThis should not be publicly available: -https://quick.qsl-webshop.com/qu_fr_fr/customer/account/login/
See:
https://aw-snap.info/file-viewer/?protocol=secure&ref_sel=GSP2&ua_sel=ff&chk-cache=&fs=1&tgt=cXVbXmsucXNsLXd7YnNoXXAuXl1t~enc -> host details
https://www.shodan.io/host/195.160.161.138front-end error in login uri:
-quick.qsl-webshop.com/fr/customer/account/login/
status: (referer=http:/XXX/web?q=puppies)saved 19701 bytes 89062791ad0f0a35b313706dc2661344b9784225
info: [script] -quick.qsl-webshop.com/static/version1535007181/_cache/merged/8ad6525cd0b4c92d631cf9bda5c59d13.min.js
info: [decodingLevel=0] found JavaScript
error: line:182: SyntaxError: invalid label:
error: line:182: "*": {
error: line:182: ........^
error: line:3: SyntaxError: missing = in XML attribute:
error: line:3: <!doctype html>
error: line:3: ..............^
file: 89062791ad0f0a35b313706dc2661344b9784225: 19701 bytes
Invalid label code reuse attack possible - method of local exploit on invalid label (pol).Response should not include disallowed 'x-powered-by' header here & 'set-cookie' header to set 'phpsessid' doesn't have the 'secure' directive. In code 'set-cookie' header to set 'phpsessid' doesn't have the 'secure' directive. In code
<input name="form_key" type="hidden" value="KxxxxxxxxxIUV2N">
polonus (volunteer website security analyst and website error-hunter)
