Order entry mixed info from two differnt customers

[Guest]

If anyone has any thoughts on this or has seen anything like this before then please let me know. Your insight will be greatly appreciated.

 

Problem: A user makes it through the check out process without error (or so they say) but recieves an email confirmation with the wrong product, shipping and billing address (the delivery address is correct). The order placed in the database has this same incorrect information.

 

The product, shippping and billing address were identical to an order placed a few days earlier by my partner while we were testing. (there were a few orders inbetween the 2 in question). The reason I know this is some error is because the product isn't one listed on the site (we only use it for testing), and the shipping option was turned off... plus, this new user's delivery address was correct, just the billing address was wrong (it was my partners home address).

 

I hope this is making sense. I can elaborate on any of this if someone thinks it will help.

 

The only theory I have right now (Please let me know if this is valid)...

Maybe the user copied the URL with the session ID during the checkout process and either put it back in incorrectly or modified it in some way. If the session ID had a character or two changed then could that possibly cause an order entry to mix information from two different orders?

 

If it were the same information as the old order then I might think it was some user error... but it has to be a database issue if it is mixing the information from two different customers into one order.

 

Thanks for any help,

RT

 

P.S. I'm using the "check out without account" contribution. This may or may not have anything to do with the issue.

 

P.P.S. I think this is an isolated incident... but it could be big trouble if people are getting email notifications with other people's billing address.

[Iggy]

HI There,

 

I have a shop set up on MS1 that has been experiencing the exact same thing. The symptoms are a user buys a product and the shipping address is another users. Seems random and we've seen it 4 times in the last 2 months.

 

Is this an exploit?

 

Thanks for any help.

 

Iggy

[Guest]

I ma having the same problem and I think it is happening when 2 different customers are ordering and signing up at the first time and the second customer does not get notified about the order and the second customer get the customer information of the first order.

 

 

This is very bad for business. But the right credit cards are being charged with the correct amounts.

 

HELPPPPPP!

[Iggy]

Seemed to have fixed the problem. Had multiple stores all running sessions from /tmp. Changed them all to mysql and haven't seen a relapse yet so I'm thinking that was the problem.

 

Hope that helps!

 

Iggy

[nesincg]

How did you change the sessions to mysql? I can't find that option in configuration.

Many Thanks,

Chris

 

Seemed to have fixed the problem. Had multiple stores all running sessions from /tmp. Changed them all to mysql and haven't seen a relapse yet so I'm thinking that was the problem.

 

Hope that helps!

 

Iggy

<{POST_SNAPBACK}>

[mugitty]

In your configure files themselves - catalog/includes/configure.php and admin/includes/configure.php

  define('STORE_SESSIONS', ''); // leave empty '' for default handler or set to 'mysql'

[trideout]

I'm seeing the exact same thing on my site and I am running my sessions via MySQL. If anyone has any ideas, this is a real bugger for me and I'm finding it nearly impossible to troubleshoot this one. Thanks

 

Tom

[trideout]

I'm dumb, nevermind, i had MySQL disabled.

Thanks all

 

tom