WHMCS - Horrific Cleaning of variables leaves multiple zero-day possibilities

[XFS_Duke]

You're playing with fire.

Why you say that? Because I'm not just gonna let this slide? Because I am trying to help the community and not just myself? Listen, the SolusVM thing could of been prevented... I know that SolusVM can patch their issues but I'm more worried now about credit card and other info that may be stored in some of the bigger companies databases... Image the possibilities for anyone who gets this exploit... Wouldn't you rather work on getting it fixed rather than bashing the person who figured it out?

But, feel free to send me a PM as to why you think I'm playing with fire...

Thanks.

 

[lulzsecurity]

Jarland, how is he playing with fire? I'm interested to see your reply.

From my point of view, I just intended to release it without contacting WHMCS honestly, but after talking to XFS_Duke I agreed to notify them at-least before.

 

[Nick_A]

How about we don't try and bash the guy... Lets listen and try and help instead of being assholes to the person thats trying to get them to fix their mistakes... Just an idea...

Perfectly willing to listen and help, but someone here needs to acknowledge that this could take a large chunk out of a host's revenue if people are going around posting exploits publicly. I'm not sure how caring about my revenue makes me an asshole. Personally, I prefer exploits to be handled discretely. He acts like he has a personal vendetta against WHMCS, and I'd really like to know why. Does it really hurt him if WHMCS doesn't fix a mistake? Maybe he has some good justification for what's doing, but I haven't seen anything but attention whoring. This thread has only been up for 1.5 hours and he's already said 3 times he is going to post some vulnerability publicly. Sounds like he'd prefer it if WHMCS does nothing.

 

[jarland]

Why you say that? Because I'm not just gonna let this slide? Because I am trying to help the community and not just myself? Listen, the SolusVM thing could of been prevented... I know that SolusVM can patch their issues but I'm more worried now about credit card and other info that may be stored in some of the bigger companies databases... Image the possibilities for anyone who gets this exploit... Wouldn't you rather work on getting it fixed rather than bashing the person who figured it out?

But, feel free to send me a PM as to why you think I'm playing with fire...

Thanks.

Because you're working with Curtis Gervais who is butt hurt over his own bad deeds in the industry and desires nothing more than to cause chaos.

 

[lulzsecurity]

jarland, I don't see any proof to backup your statement on my real identity. All I see right now is someone jumping to conclusions.

 

[XFS_Duke]

Because you're working with ****** who is butt hurt over his own bad deeds in the industry and desires nothing more than to cause chaos.

Not working with him... Trying to make sure everything gets resolved without anymore websites getting attacked... Simple as that... But by all means... If he releases it, and your site gets hacked... Don't blame me... I've done everything I could... From contacting WHMCS, Hostbill and SolusVM...

 

[jarland]

jarland, I don't see any proof to backup your statement on my real identity. All I see right now is someone jumping to conclusions.

You are Curtis Gervais. I don't need proof. Prove to me that you're not.

 

[lulzsecurity]

@jarland I still see no proof to backup that statement.

 

[D. Strout]

For goodness sakes... MannDude or mods, check the IPs of this exploit-threatening clown and see if they match up with netnub.

Even if you're not Curtis G, you really shouldn't just go throwing 0-days around. It shouldn't take the mind of a rocket scientist to see how that's a bad idea.

 

[lulzsecurity]

I'm pretty sure newbie programs could do better then WHMCS right now....

global $CONFIG;

global $PHP_SELF;

global $remote_ip;

 

 

$PHP_SELF = $_SERVER['PHP_SELF'];

$this->remote_ip = $this->get_user_ip(  );

$remote_ip = $this->load_config_vars(  );

$CONFIG = $this->load_input(  );

 

[KuJoe]

@jarland I still see no proof to backup that statement.

XFS_Duke confirmed it in one of his posts. Just pointing that out so we can get back on target because who you are doesn't matter IMO.

 

[lulzsecurity]

Actually XFS_Duke confirmed it in one of his posts.

Where do you see that?

 

[KuJoe]

Because you're working with Curtis Gervais who is butt hurt over his own bad deeds in the industry and desires nothing more than to cause chaos.

Not working with him... Trying to make sure everything gets resolved without anymore websites getting attacked... Simple as that... But by all means... If he releases it, and your site gets hacked... Don't blame me... I've done everything I could... From contacting WHMCS, Hostbill and SolusVM...

He is implying that he is not working with you but trying to prevent you from releasing more exploits publicly. The pronoun "him" in "Not working with him..." and "he" in "if he releases it" is used in place of the noun that jarland provided "Curtis Gervais".

 

[lulzsecurity]

There is nothing implyed there. From what I see there is he states he is not affiliated with the person in any way/shape/form and doesn't confirm or deny the identity of this set person. As XFS-Duke confirms is that is a Male by using "he".

 

[jarland]

He is implying that he is not working with you but trying to prevent you from releasing more exploits publicly. The pronoun "him" in "Not working with him..." and "he" in "if he releases it" is used in place of the noun that jarland provided "Curtis Gervais".

I'm just tired of it. We all know it's a good thing that people be held accountable for their code, but in the meantime some of us would just like a little rest instead of this constant knight in shining armor routine.

 

[MCH-Phil]

It's all about attention, otherwise he or she would have just contacted the developer and quietly let them fix it.  

Let's break this down and be honest here.  You have provided no way to fix the issue.  Nor even a way to mitigate the issue until WHMCS can fix their screw up.  You really haven't provided even enough information for seasoned people to resolve it on their own in a timely fashion.  

It's all I know something, is broke, and you don't.  I contacted the developer and if they don't fix it, I'll make sure it can be used against you.

So what was the point of this?  Attention.  Plain and simple.

Go outside and play while you still can.  One of the people you piss off one day will surely make sure you don't see the light of day for a while.

 

[lulzsecurity]

It's all about attention, otherwise he or she would have just contacted the developer and quietly let them fix it.  

Let's break this down and be honest here.  You have provided no way to fix the issue.  Nor even a way to mitigate the issue until WHMCS can fix their screw up.  You really haven't provided even enough information for seasoned people to resolve it on their own in a timely fashion.  

It's all I know something, is broke, and you don't.  I contacted the developer and if they don't fix it, I'll make sure it can be used against you.

So what was the point of this?  Attention.  Plain and simple.

Go outside and play while you still can.  One of the people you piss off one day will surely make sure you don't see the light of day for a while.

Not about attention, just warning. If they don't fix it, then you can't say no one warned you about the vulnerabilities...

A patch to fix this will be given to verified providers via private message on request along with all changes made to file documented.

 

[MannDude]

For goodness sakes... MannDude or mods, check the IPs of this exploit-threatening clown and see if they match up with netnub.

Even if you're not Curtis G, you really shouldn't just go throwing 0-days around. It shouldn't take the mind of a rocket scientist to see how that's a bad idea.

Sorry, was making food and then eating it. Checkign it all out now.

EDIT: A quick look at the IP log, 'lulzsecurity' and 'netnub' don't share any IP addresses. Then again, most of us here probably have a VPN or (multiple) and know what Tor is and how to use it. It's not entirely helpful banning by IP.

 

[D. Strout]

Sorry, was making food and then eating it. Checkign it all out now.

There's a coincidence, I did that too earlier. Thanks for checking this.

 

[upsetcvps]

lulz is doing nothing wrong here.  Would you rather he say nothing and others exploit?  He's forcing wmhcs' hand to pay attention and patch.  The ball is in their court.