Action Required!
We have detected malicious activity towards X-Cart stores on versions 5.0.x- 5.4.1.x. Your X-Cart store is based on the affected version. As a result, a cybercriminal can gain full admin access to your online store.
You don’t have to do anything if your store is hosted on the X-Cart server. We’ve already fixed the vulnerability on your behalf. If you are using your own hosting service, please follow the steps below to resolve the issue.
The vulnerabilities include the following unautorized changes in your store’s settings*:
- unauthorized creation of a new root admin,
- email addresses in Store Setup → Store profile → Contacts,
- settings changes in Store Setup → Localization → Time zone
- new PayPal Express Checkout linked to an unauthorized email address
- changes made to the year when the store opened
If you are using the X-Cart 5.4.1.x edition, you must immediately upgrade your X-Cart store to 5.4.1.48 version to resolve the issue.Upgrade your store on your own or contact us to implement the upgrade on your behalf.
To fix the vulnerability and ensure your store is secure, follow the steps below:
- Delete ./Includes/install/ subfolder and its contents from ./Includes/ folder from your store’s files on the server
- Go to Admin panel → Store → Users to check all Administrator accounts. Remove the service-client@x-cart.com admin or any other unauthorized emails.
- Check and correct the settings mentioned above.* Restore your regular settings and ensure that all unauthorized changes have been deleted.
Block requests to read configuration files at the server level:
Nginx if ($args ~ (config.php|config.local.php|.env)) { return 403; }Apache <IfModule mod_rewrite.c> RewriteEngine on ApacheRewriteOptions InheritDown RewriteCond %{QUERY_STRING} (config.php|config.local.php|.env) [NC] RewriteRule .* – [F,L] </IfModule>- Change Installer auth_code. To do that, find the auth_code setting in the etc/config.php configuration file and replace its value with a random 32-character string.
- End all admin sessions and change all admin passwords. Log out all admins, including the one you are currently working under. To log out an admin, go to Users → Admin’s profile, and click Log out this user.
- Regenerate Safe Mode key if you are using an X-Cart version older than 5.4.0.0. To do that, go to admin.php?target=safe_mode and click Regenerate links.
- Regenerate API keys. If you have the XC-RESTAPI module installed, go to Admin Panel → My apps → My addons. Find the XC-RESTAPI module and change the API keys in its settings if they are not empty.
