[Skip to main content](#vessel-content) # Vulnerabilities detected in Hikashop. ## - **[aspirationimages](/forum/user/57967-aspirationimages "View aspirationimages's Profile")** - [![aspirationimages's Avatar](https://www.hikashop.com/media/kunena/core/svg/person.svg)](/forum/user/57967-aspirationimages "View aspirationimages's Profile") Topic Author - [ Offline](/forum/user/57967-aspirationimages) Less More - Posts: 28 - Thank you received: 4 - - 1 month 2 weeks ago - 1 month 2 weeks ago [\#373424](#373424) by [aspirationimages](/forum/user/57967-aspirationimages "View aspirationimages's Profile") *[Vulnerabilities detected in Hikashop.](/forum/25-install-update/910826-vulnerabilities-detected-in-hikashop#373424 "-- url of the page with the problem -- : aspirationimages.com -- HikaShop version -- : 6.6.0 -- Joomla version -- : 5.4.8 -- PHP version -- : 8.2.33 -- Browser(s) name and version -- : Safari 26.5.2 Vulnerabilities detected in Hikashop. My website was hacked and I updated Joomla to 5.4.8 as I can't do Joomla 6 because PHP needs to be 8.3. I installed Website Antivirus Scanner for Joomla and it has reported many files in Hikashop as being vulnerable, almost all of the payment plugins.. Whether it is or isn't, why is it being reported and what can be done to fix this please? See attachment")* was created by *[aspirationimages](/forum/user/57967-aspirationimages "View aspirationimages's Profile")* -- url of the page with the problem -- : [ aspirationimages.com](https://aspirationimages.com) -- HikaShop version -- : 6.6.0 -- Joomla version -- : 5.4.8 -- PHP version -- : 8.2.33 -- Browser(s) name and version -- : Safari 26.5.2 Vulnerabilities detected in Hikashop. My website was hacked and I updated Joomla to 5.4.8 as I can't do Joomla 6 because PHP needs to be 8.3. I installed Website Antivirus Scanner for Joomla and it has reported many files in Hikashop as being vulnerable, almost all of the payment plugins.. Whether it is or isn't, why is it being reported and what can be done to fix this please? See attachment - [ ![Screenshot 2026-09-16 at 8.23.51 AM.png](/forum/attachment/63447) ](/forum/attachment/63447 "...8.23.51 AM.p") [ ](/forum/attachment/63447?download=1 "...8.23.51 AM.p") - [ ![Screenshot 2026-09-16 at 8.24.13 AM.png](/forum/attachment/63448) ](/forum/attachment/63448 "...8.24.13 AM.p") [ ](/forum/attachment/63448?download=1 "...8.24.13 AM.p") - [ ![Screenshot 2026-09-16 at 9.14.39 AM.png](/forum/attachment/63449) ](/forum/attachment/63449 "...9.14.39 AM.p") [ ](/forum/attachment/63449?download=1 "...9.14.39 AM.p") Last edit: 1 month 2 weeks ago by [aspirationimages](/forum/user/57967-aspirationimages "View aspirationimages's Profile"). Reason: Adding new vulnerability Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzI1LWluc3RhbGwtdXBkYXRlLzkxMDgyNi12dWxuZXJhYmlsaXRpZXMtZGV0ZWN0ZWQtaW4taGlrYXNob3A/dG1wbD1tYXJrZG93bg==) or [Create an account](/register) to join the conversation. - **[nicolas](/forum/user/63-nicolas "View nicolas's Profile")** - [![nicolas's Avatar](https://www.hikashop.com/media/kunena/avatars/resized/size144/users/avatar63.png?1793428657)](/forum/user/63-nicolas "View nicolas's Profile") - [ Away](/forum/user/63-nicolas) Less More - Posts: 86324 - Thank you received: 14285 - - 1 month 2 weeks ago [\#373425](#373425) by [nicolas](/forum/user/63-nicolas "View nicolas's Profile") Replied by *[nicolas](/forum/user/63-nicolas "View nicolas's Profile")* on topic *[Vulnerabilities detected in Hikashop.](/forum/25-install-update/910826-vulnerabilities-detected-in-hikashop#373425 "-- url of the page with the problem -- : aspirationimages.com -- HikaShop version -- : 6.6.0 -- Joomla version -- : 5.4.8 -- PHP version -- : 8.2.33 -- Browser(s) name and version -- : Safari 26.5.2 Vulnerabilities detected in Hikashop. My website was hacked and I updated Joomla to 5.4.8 as I can't do Joomla 6 because PHP needs to be 8.3. I installed Website Antivirus Scanner for Joomla and it has reported many files in Hikashop as being vulnerable, almost all of the payment plugins.. Whether it is or isn't, why is it being reported and what can be done to fix this please? See attachment")* Hi, I checked the list of files in your report and all of them are legitimate HikaShop files. Nothing there is a file added by a hacker, they are all part of the normal package: the payment plugins, the FedEx shipping plugin, our modules, our fields and our views. The detection type displayed in the report, php.var.function.14, is a heuristic rule of that scanner. It flags normal PHP constructions, like calling a property or a method whose name is stored in a variable, or using base64_decode to pass data in a URL. HikaShop uses these constructions in many places, and so do many other extensions. Akeeba Backup had exactly the same php.var.function.14 detection on one of its own files and it was a false positive there too. So that report alone does not mean that these files are infected. Note also that the free version of that scanner hides most of the paths behind FREE REPORT LIMITS, so you cannot even see which files it is actually talking about. That said, as your website was really hacked, it is worth verifying instead of just ignoring the report. The simplest way is to download the package of your HikaShop version from your account on our website and to install it again on your site. That overwrites every HikaShop file with a clean one, the plugins included. Then run the scan again. If the same files are still listed, it is the heuristic rule and not an infection. For Joomla itself, you can do the same for free with Joomla's own tool: go in System, Update, Joomla, and use the Reinstall Joomla core files button. It overwrites all the core files with the clean ones of your version. If you want to check file by file, unzip that package on your computer and compare its content with the files on your server, with a diff tool or through your FTP client. A HikaShop file which is different from the one in the package is a file worth looking at. It is also useful to look for files which are in those folders but not in the package at all, and for files with a recent modification date, because that is usually how an infection shows up, much more than through the file names of that report. About the scanning tools, here are free ones which we find more useful in your situation: JAMSS, the Joomla Anti-Malware Scan Script. It is a single free PHP file that you upload at the root of your site, call in your browser, and delete afterwards. It also works by patterns, so it gives false positives too, but it shows you the file and the line which triggered the alert, so you can judge each hit by yourself instead of getting a list of hidden paths. You can get it here: [ github.com/btoplak/Joomla-Anti-Malware-Scan-Script--JAMSS-](https://github.com/btoplak/Joomla-Anti-Malware-Scan-Script--JAMSS-) Sucuri SiteCheck, on [ sitecheck.sucuri.net](https://sitecheck.sucuri.net) : free and nothing to install, it scans your site from the outside and tells you if injected content or a blacklisting is visible on your pages. It only sees what is public, so it complements the file scan, it does not replace it. If you have an SSH access to your server, php malware finder is the most precise of the free tools, it uses yara rules and is much less noisy on legitimate code. You can get it here: [ github.com/jvoisin/php-malware-finder](https://github.com/jvoisin/php-malware-finder) Akeeba Admin Tools, on [ www.akeeba.com/products/admin-tools.html](https://www.akeeba.com/products/admin-tools.html) : it has a free Core version which is very good to harden the site after the cleaning, but be aware that its PHP File Change Scanner is only in the paid Professional version. If you find HikaShop files which really differ from the ones in the package, paste their content here and we will tell you what was added. Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzI1LWluc3RhbGwtdXBkYXRlLzkxMDgyNi12dWxuZXJhYmlsaXRpZXMtZGV0ZWN0ZWQtaW4taGlrYXNob3A/dG1wbD1tYXJrZG93bg==) or [Create an account](/register) to join the conversation. Board Categories HikaShop Install & Update Product & Category Display Content Creation Sales and Orders Orders management Reports & Statistics Customers Checkout Payment Methods Shipping Methods Import & Export (CSV, XLS…) Specific Features Affilation Taxes Wishlist Vote Carousel & Slider Mass Actions Filters & Search Discount & Coupon Feature Request Integrations Showcase General Talk about HikaShop Development HikaShop 3.0 Beta Translation Commercial Jobs HikaShop Components HikaMarket Market: Feature requests Market: How to? Market: Bug Report HikaSerial General talk about HikaSerial Serial: Bug Report Serial: How to? Support en Français de HikaSerial (French Support) HikaSubscription HikaAuction Auction: Feature requests Auction: How to? Auction: Bug report Hikashop around the world Support en Français (French Support) Russian FAQ. Курс выживания с Hikashop. Частые вопросы и о Расширения Hikashop Наши сайты на Hikashop 日本語版サポート(Japanese Support) Thai German Archives Bug Report How to? [](/forum/topics/feed/mode-topics?format=feed&type=rss) Time to create page: 0.074 seconds [Powered by](/forum/credits) [Kunena Forum](https://www.kunena.org)