Professional Linux & Windows Server Management & Security Services (cPanel, Plesk, DirectAdmin and others)

 We provide a wide range of server management plans. You can completely customize your order or feel free to contact us. All of our experts are highly trained and certified. You can rest assured that you’re always in safe hands.

Our Server Management services:

Linux Server management

Windows Server Management

VPS Node management

Feel free to contact us for any customized or additional requests by clicking here

WHMCS SQL injection Exploit

** A patch was released. See http://blog.whmcs.com/?t=80223  

WHMCS, a popular billing/support/customer management system, is still suffering from critical SQL injection issues. Today, yet another vulnerability, including exploit was released. 

Due to the fact that there is no patch available at this point, I will refrain from linking to any exploit details, but it is pretty trivial to find the respective blog post which includes a script to exploit the vulnerability. WHMCS acknowledged the problem.

The root cause of this problem, as well as prior problems with the software, appears to be a lack in understanding of proper controls to prevent SQL injection. Good input validation is just a start, but prepared statements are a must. Instead, the WHMCS developers used a rather complex (and buggy) function to escape user input and assemble dynamic SQL queries.

The bug is in a function used throughout WHMCS, so the exploit is not limited to a particular URL.

http://blog.whmcs.com/?t=80206