New customer auto-logged in to previous customer's account

You are presently using: v1.5.7b
HTTP Server: ApachePHP Version: 5.6.40 (Zend: 2.6.0)PHP File Uploads: OnUpload Max Size: 500MPHP Memory Limit: 512MPOST Max Size: 256MDatabase Engine: MySQL 5.5.5-10.3.28-MariaDBDatabase Host: localhost (127.0.0.1)Database Date: 04/14/2021 20:17:58Database Data Size: 25,247 kBDatabase Index Size: 4,827 kBMySQL Slow Query Log Status: OnMySQL Slow Query Log File: server6-slow.logMySQL Mode: NO_ENGINE_SUBSTITUTION

A customer in VA orders items from my Zen Cart website.
He is somehow automatically logged in on a previous customer's login in IL. who had ordered 7 min. prior.
The VA customer's CC# pays for new items to be delivered to the previous customer in IL.

This VA. customer is in cybersecurity for a large corporation and he explains everything he did for this to happen. How could he find himself logged into the previous IL. customer's account?

Mark

Usually such a thing only happens when a storeowner sends an email blast to customers, and in that email puts a link to their store that also includes a zenid in the URL.

Is that how these customers began their shopping session today? ie: did they both click on a link in an email you sent to them encouraging them to buy during a promotion etc?

Nope. I don't use my own server for any outgoing mail. Also, I recalculated the time elapsed and it was more like 52 min. between orders.

It wouldn't matter what server was used to send outgoing mail. It matters that someone (okay, maybe not you, but someone who knows both those customers) has most likely enticed them to click the same link in order to shop at/around the same time.

The 52 minutes is interesting, but it only tells when the order was "completed", not how long each shopper was active and when they started.

You didn't say whether you've talked to both customers to determine exactly how they began their shopping journey today.

You didn't talk about what payment module was used.
You didn't mention what plugins you have installed and all the ways in which your store is not the same as unaltered original Zen Cart code.

The original unaltered Zen Cart application doesn't allow what you described, unless two shoppers use the same unexpired zenid. And the only way they could be given the same zenid is if someone who knows both those people sends them an identical link to click in order to start their shopping session using that same session while the other is already active.

Other "forms" of this could include:

• you the storeowner adding your own extra links to various pages in your site (such as manually editing template files and adding links, or adding links via ez-pages or define pages), where you include the zenid in the URL
• you are using a template or plugin or customized code that generates links incorrectly
• you are using a plugin that lets you past links via the Admin to show up in various places on the storefront and you've added a zenid to the URL

Based on your description, in addition to believing it came from two people visiting the same link that contained the same zenid (session id), I'm also immediately suspicious of all your plugins, your template, your payment modules, etc, for maybe they've changed the core operation of Zen Cart and unwittingly introduced a security problem.

Logical Position handles my Google Adwords account. I'll ask Anne about template files and outdated mods since she has just recently updated my cart, I feel certain she would not install anything outsecure. I'm 100% SSL and up to date with no customized code.

And I only use Authorize.net
The one thing I can't understand is why the IP Addresses listed in the bad order ie: 216.99.180.227 - 68.100.125.134 was not identical.

Is there some reason Anne can not see this thread? "I am logged in, but that forum is private so I can't see the threads."

Yes, this section of the forum is not public. Only people who create the thread can see the thread, and a select few forum moderators familiar with security issues.
The reason for this is that if someone is sharing details of an actual hack or a true security vulnerability in the software then hackers won't be able to see this discussion and infiltrate other stores using the information.

You can copy/paste the information to whomever else needs it.