Suddenly getting multiple submissions issue to Authorize.net AIM

[daedylus]

Client is running v1.3.7 of Zen Cart (yep, I know that's old and should be upgraded). Since we've taken on this project, we've added the Edit Order and Login as Customer modules (may not be relevant for this issue, but at least wanted to bring it up).

The site had been running smoothly for quite some time, but within the last 24 hours, about 90% of orders cannot be processed. Upon trying to confirm their order, customers are brought back to the payment page with an error stating "The credit card was declined for the following reasons", but the message does not include why.

I've turned on debugging within the AIM module and have noticed TWO logs being created per order. The first log message says the order was approved:

[0] => 1|1|1|This transaction has been approved.

The second log message though says the following:

[0] => 3|1|11|A duplicate transaction has been submitted.

My question is, why is Zen Cart submitting this transaction twice to Authorize.net? Authorize.net is handling this correctly as they get the first transaction and send an approve message, and then get the second transaction and send the duplicate message. However, Zen Cart sees the duplicate message and thus does not allow the order to go through on the site.

I've searched for the forums for similar issues, such as this one:
http://www.zen-cart.com/forum/showthread.php?t=187615 , and the only comment appears to be to upgrade. Is there no fix for multiple submissions other than to upgrade? Could this also be due to users clicking on the submit button multiple times, and could some javascript that disables the button after a single click resolve the issue?

Any help would be appreciated. Thanks!

[delia]

The owner is positive sure that this is not happening because of the customer hitting the submit button twice because he has tested it himself. It also started happening all of sudden with no files changes to start a new reaction.

Due to the age of the version, I am worried about hacking but never have heard of anything that affects a cart this way. There's always a first time.

[delia]

If you open a new account, the duplication does not occur. It's only happening on existing account.

[DrByte]

There are all kinds of possible contributors:
- old version with well known security vulnerabilities, so could have been hacked
- users submitting multiple times (template and javascript for protecting against that was fixed in a version newer than yours)
- an addon you've added has altered the normal flow and is causing a loop and resubmission

I can't think of anything off the top of my head that would cause "pre-existing" accounts to be affected and not "new" accounts, at least not as far as original core code is concerned.

The MOST important factor in this whole thing is the SUDDEN nature of the onset of the problem. THAT is what you should focus on in order to get your short term fix.
And your NEXT MOST IMPORTANT thing is to UPGRADE. Not just to fix today's "presenting problem", but to fix the GLARING security holes that exist on your site.

[delia]

Mirrors my advice but wanted to make sure I wasn't missing anything. Conferencing this morning with the developer who started this thread and proceeding with a complete upgrade. I did find evidence of a hack though looked to be minor comparatively. We're planning to upgrade but not in place. Starting over again in another directory and wiping out the original site to make sure we get rid of any problematic files.

Thank you Dr Byte for responding!