WHMCS 24/10/2013 Vuln

[DamienSB]

http://localhost.re/p/whmcs-v5210-vulnerability

FOUR..

This isnt a really big issue, but it does give people the ability to get name/address/phone number from other customers.

 

[Magiobiwan]

http://localhost.re/p/whmcs-v5210-vulnerability

You've got to be kidding me. ANOTHER ONE.

EDIT: On a related note, http://pastie.org/8428341

 

[trewq]

Ridiculous.

 

[serverian]

Put this in configuration.php to patch it:

if(isset($_REQUEST['invoiceids']) && is_array($_REQUEST['invoiceids'])) { die('no'); }

 

[Magiobiwan]

On a related note, http://pastie.org/8428341. This is freaking RIDICULOUS. 

 

[HostVenom - Brandon]

I would hope a security audit is already in progress with these constant problems.

 

[perennate]

Edit: nevermind

 

[XLvps]

I may just go back to old school paypal "buy it now" buttons. 

 

[scv]

Yeah, desire to build a WHMCS replacement rising.

 

[DragonDF]

Everyday a new one?
heeheheh



Some providers are working on it now. WHM is down!

 

[MannDude]

Merged the 3 threads into one.

 

[WSWD]

http://blog.whmcs.com/?t=80587

 

[jarland]

Excel spreadsheets and email addresses for your company like reboot@ or reinstall@. That'll secure it.

 

[Kakashi]

Another day another vulnerability -_-

 

[WebSearchingPro]

Just a little note, this post was posted at 01:01:01 AM +0000 October 25th 2013 - So there may be something more sinister in the making.

 

[rds100]

Fuck this shit. Anyone moved to Blesta? Does it work well? I'm considering it...

 

[Raymii]

Maybe they're going to do a 12 days of christmas, 12 days of WHCMS exploits later on in december

 

[tallship]

Yeah, desire to build a WHMCS replacement rising.

There remains the promise of http://WHSuite.com but no word on progress at all. And then there's Blesta, which has promise w/the participation of 3rd party developers, yet w/o that is still pretty much just a billing platform for webhosting.

HostBill works nicely, when it works at all, and if you're really daring you can even take a chance on destroying your entire business each week by performing updates, which usually break something else that was previously working, but only a fool would consider that app now.

I'm actually considering going back to a simple script based system much like http://prgmr.com/ - or at least re-deploying under a different brand for those services.

 

[peterw]

Another day another vulnerability -_-

Sad bad true.

 

[GIANT_CRAB]

New patch was released but the version number doesn't change after updating.

I guess they're paying "so much attention" to fixing the issue that they "accidentally forgot" about the version number.

Even minor issues like this (version number) are overlooked, its really unsafe to continue using WHMCS.