Fake URL injection in homepage - nop 3.00 site.

Hi,

I have exactly the same pb (picture url replacement).
When I see that, I go to administration console and clean the cache and Everything is OK after.

So it means that StoreURL cache is been changed somewhere.

I'm looking at the nopCommerce code and I hope I'll find something. But actually, StoreRepository - update - seems to be reached only in 1 condition with the admin view.

NB: I'm using nopCommerce 3.2

Good afternoon,

And congrats ssolescu for this great explanation of this problem and a lot of work to find out the cause.

I have suffered today the same problem with pictures in featured products pointing to baidu.
I have 3.4 nop version, installed in a shared hosting with asp and sql servers in UK and Holland.

The problem appeared even the store was closed, because it's not open to public yet.

Have anybody founded any later new possible cause and safe solution?

Thank you in advance for an excellent product and the contributions.

Kind regards,
Antonio

Antonio E wrote:

Hi,

I think your server must have a virus on it.  What hosting company are you using?  Also, are you using any third party plugins?  I think you should contact your hosting company and have them check the whole server to see if there is a virus somewhere else on the server that is affecting your site.  Have you tried searching the files on your hosting account to see if you can find the corrupted file?

Hi Tim,

Thanks for your fast answer and help.
I have contacted with the support team of the hosting, that always work fast, and they say the server is ok.

Now the problem has gone, the same that happened for ssolescu and RichardC.
In the site logs previous to the failure there are some accesses from Bildu spider, as well as Google bots, but maybe it's not relevant.

My concern is not knowing if it may happen again at anytime.
Since it happend to 3.00, 3.2 and 3.4 nopcommerce versions (ssolescu, RichardC, and me) in different environments

Same problem was also described by imnop
https://www.nopcommerce.com/boards/t/30332/why-are-images-pointing-to-baiducom.aspx

So, I guess maybe other users are having the same problem.

Any help would be very appreciated. Thanks!

Added: Nop-templates ArtFactoy theme + free plugins

Antonio E wrote:

Have you tried downloading a copy of your website from your server and then searching all the files for a term in one of the corrupted links?

By free plugins do you mean plugins developed by the nopCommerce team or other extensions?  If you are using plugins not deployed with nopCommerce, you might send a PM to some of the other people in this and the other thread that are having the same problem to see if they are using the same free plugins.

It sounds to me like it's a problem with a virus being on the server somewhere and just that your hosting company can't find it.  Do you have a link to your website that I can take a look?

Hi Tim,
Thanks for your post.

No, I did'nt search for differences, because after a while (restarting the application) , the links were right again.
ssolescu and RichardC did the comparision with no success.

The plugins come for free with the template Art Factory, by nop-templates.

I'm sending you a private msg with the link, since I'm not allowed to put in public.

Thanks!
Antonio

When you see it happen again, try viewing the source of the page and saving it as a html file as well as any javascript files linking to the page that is corrupted.  Then if you send me the links  through a PM I will take a look.  I am thinking it is some javascript on the page that is causing it.

Hi Tim,

Thanks for your help. I will do as you say.

Regards,
Antonio