WHMCS Security Exploit+Patch

[Glenn]

A security issue has been discovered that we consider to be of a high severity, and as a result we have decided there is a need to release an immediate patch for it.

Although not related to the new release, it is unfortunate timing so soon after the release, but we take security very seriously and so if an issue becomes apparent to us, we will always issue a patch immediately for it as our track record with patches in recent years demonstrates.

Applying the patch is very simple. It's just a single file to update. There are separate versions of the file for each release of WHMCS from V4.0 up to the very latest V5.0 release. The patch download consists of a single file which just needs to be unzipped, and then uploaded to the /includes/ folder replacing the existing file. Download links are as follows:

Version 4.0.x -> http://www.whmcs.com/members/dl.php?type=d&id=107
Version 4.1.x -> http://www.whmcs.com/members/dl.php?type=d&id=108
Version 4.2.x -> http://www.whmcs.com/members/dl.php?type=d&id=109
Version 4.3.x -> http://www.whmcs.com/members/dl.php?type=d&id=110
Version 4.4.x -> http://www.whmcs.com/members/dl.php?type=d&id=111
Version 4.5.x -> http://www.whmcs.com/members/dl.php?type=d&id=112
Version 5.0.x -> http://www.whmcs.com/members/dl.php?type=d&id=113

If you have any questions or need any assistance applying the patch, please do not hesitate to contact us.

We apologize for the inconvenience.

* An email notification is going out to all active license holders
* All client area downloads have been updated to include this by default

Patch Your WHMCS Before you are HACKED!

Courtesy

Glenn Reviewed by Glenn on 4th Dec 2011. WHMCS Security Exploit+Patch Patch Your WHMCS Before you are HACKED! Courtesy Rating: 5

[Lifetalk]

Out of interest, what IS the security issue? That is to say, what does it allow the exploiter to do?

[downote]

The vulnerable code is located under cart.php which contains:

    if ( $a == "add" )
    {
       $templatefile = "configureproductdomain";
        ....etc
    }

    if ( $a == "login" )
    {
        $templatefile = "login";
        ....etc
    }
     ...
    outputClientArea( $templatefile, $nowrapper );
    # outputClientArea function will display
    "./templates/orderforms/cart/{$templatefile}.tpl"

[Krun!x]

Out of interest, what IS the security issue? That is to say, what does it allow the exploiter to do?

It allows attacker to insert a malicious PHP script to WHMcs assuming he can write to any directory inside public_html.

Here is my patch which prevents uploading ANY files inside public_html in case there are other exploits out there.
http://www.besthostingforums.com/10-...tch-whmcs.html

[gfxguru]

thanks guys

[dark_hunter]

So this is what screwed Servedome and Boxslots?

[xentos]

High likely yes, although there is a patch for it and if they are not fast enough to apply the patch there is a big chance it will be used on you.

they can decompile both old and new patched file and find the exploit. that's why it's rather annoying, by the time you receive a mail from whmcs 100.000s people know about it. and there are always one or two who like to exploit it.