The history of a single template or backdoor from myopencart.net

Foreword

Once I asked a friend to see why he could not install the template on the CMS Opencart .

Sends a link to the site, access to the administrative part and hosting. I go, I see a template in the theme directory ( / catalog / view / theme / ). Having a little understanding of the system structure, I understand that there is no tool for loading templates, as for example, in WordPress. Adding a new theme is loading the necessary files into specific folders. A CMS "learns" about the available templates by scanning the folder with the themes.

So, the solution to the problem was trivial, the template was just incorrectly loaded. In this case, it had to be downloaded from the root of the site.

Decoupling

This would have ended the story, but in the archive there were “extra” files and replacing existing ones not related to the template. And I wondered what was missing, what was needed to be replaced.
Some scripts were added to the controllers, localization files and replaced with /system/library/response.php .
')
The most interesting was the last file, where I found these lines:

In the original file, of course, this was not.

After decoding, this naturally turned out to be a backdoor :

This code not only replaces the links of competitors and the official site, but also allows you to manage the content of the page.

From the above server, the response is returned:

 </body></html> 

But what prevents to return the jp php-code .

So it goes.

Conclusion

To check and confirm my concerns, I went to the official website opencart.com in the "Partners" section. Where is the office. Russian site opencart.ru , in fact , this confirmed that myopencart.net is a phishing site.

Be careful and check what you install!