Unupdated online store websites based on the popular e-commerce platform Magentoare still susceptible to hacking.
Following the disclosure of technical details about a critical vulnerability identified in the Magento e-commerce platform, online stores that rely on this solution have gradually begun to apply the available patch, but the process is slow and thousands of websites are still susceptible to attacks.
[alert variation=”alert-info”]This specific vulnerability was patched by Magento security engineers last February, however few administrators rushed to secure their eshops after the release of the corresponding patch.[/alert]
E-shops need to be informed, as the risk is great.
Willem de Groot, co-founder of Byte – a company that provides hosting for websites running on Magento – said last Friday that there are about 88,000 stores that still need to update their e-commerce software, while in just one day about 10,000 stores applied the patch.
The vulnerability was discovered in January by Check Point researchers, who secretly disclosed it to Magento. Last week, however, the company went on to publish a report on the remote code execution vulnerability, including elements that would allow an attacker to create an exploit and take advantage of the vulnerability.
The risk is high because successful attacks can lead to a complete breach of vulnerable stores, meaning customer data, as well as confidential financial information, could be leaked.
As Check Point points out in a video presenting the vulnerability, another risk is that hackers can make purchases without paying a dime.
The Magento patch is available for download (SUPEE-5344), but installing it is not the easiest thing, which partly explains the slow updates of eshops. To make things easier, Byte has created a wiki page with installation instructions.
