Jon.Fatino
New Member
Thats a pretty bad one right there... Hope it gets fixed asap.
New WHMCS Exploit
- Thread starter Aldryic C'boas
- Start date
Shamelessly copied it as well :wub:
Lets all include Buyvm support e-mail as well, then we can take the day off
Hopefully everyone changed those minor details 
Incremental patch: http://www.whmcs.com/members/downloads.php?action=displaycat&catid=1
People now seem to be suggesting this only affected 5.2.7 ...I find that hard to believe.
It affected all 5.x, didn't check it on 4
You have bigger issues if you're still running 4.x
Aldryic C'boas
The Pony
It's an old file, from back in the <4.* days. I find it very hard to believe that they would take a secure, working file and replace it with such a massive security hole - so there's every reason to assume that all WHMCS versions are affected.
JackDoan
New Member
Including a python script to take advantage of it? Talk about responsible disclosure. -_-
Edit: localhost.re includes the script, not Aldryic. Important detail for those who don't actually click the link.
Last edited by a moderator:
RiotSecurity
New Member
That's fine by me. I'd hate to see good old Robert Clarke hit...
oh wait.
oh wait.
lbft
Active Member
The first provider emailing with bad news, ShardHost:
URGENT - Recent WHMCS Exploit
Upon investigation in light of the recent WHMCS exploit (http://blog.whmcs.com/?t=79427) it has been discovered that our client database was accessed as a result of using this exploit. Although client area passwords are not stored in plain text it is advisable that you change passwords as a matter of precaution. KVM root server passwords are not affected as these are not stored at all.
Although we patched our systems as soon as we were able to it seems we were one of the first targets. We have since restored a clean restoration of our billing system prior to the attack and have confirmed this is no longer vulnerable to the particular attack vector used.
We apologise sincerely for this breach of your trust and are deeply disappointed ourselves in the trust we place in WHMCS as a third part billing software provider.
If you have any questions on this matter, please contact us via support ticket; where we will be happy to discuss this matter in detail.
Again please accept our apologies on this matter.
I doubt this will be the last, unfortunately, although I'm more worried about the customers of the providers that either don't notify them or don't even know they were exploited.
URGENT - Recent WHMCS Exploit
Upon investigation in light of the recent WHMCS exploit (http://blog.whmcs.com/?t=79427) it has been discovered that our client database was accessed as a result of using this exploit. Although client area passwords are not stored in plain text it is advisable that you change passwords as a matter of precaution. KVM root server passwords are not affected as these are not stored at all.
Although we patched our systems as soon as we were able to it seems we were one of the first targets. We have since restored a clean restoration of our billing system prior to the attack and have confirmed this is no longer vulnerable to the particular attack vector used.
We apologise sincerely for this breach of your trust and are deeply disappointed ourselves in the trust we place in WHMCS as a third part billing software provider.
If you have any questions on this matter, please contact us via support ticket; where we will be happy to discuss this matter in detail.
Again please accept our apologies on this matter.
I doubt this will be the last, unfortunately, although I'm more worried about the customers of the providers that either don't notify them or don't even know they were exploited.
Aldryic C'boas
The Pony
Passwords aside - that's a lot of names/emails/physical addresses that just got leaked. Those folks won't be happy.
That is definitely useful but things such as WHMCS (or really any web application) should be behind a WAF. Most generic SQL injection rules would have prevented this - I know ours prevented the exploit from even getting to WHMCS.
I'd recommend taking a peak at ASL's modsec rules - they're robust and very well done (modular to boot as well)!
Did you get them to work with LiteSpeed?
