Menu
Web hosting firms at risk from critical vulnerability in WHMCS billing and support system

Web hosting firms at risk from critical vulnerability in WHMCS billing and support system

WHMCS developers released security updates to close publicly disclosed SQL injection vulnerability

The developers of WHMCS, a popular client management, billing and support application for Web hosting providers, released emergency security updates Thursday to patch a critical vulnerability that was publicly disclosed.

The vulnerability enables attackers to execute SQL injection attacks against WHMCS deployments in order to extract or modify sensitive information from their databases.

U.K.-based WHMCS, released versions 5.2.8 and 5.1.10 of the software to fix the flaw, as well as incremental patches that can be applied manually to older versions without performing a full upgrade.

The SQL injection vulnerability was disclosed Thursday on a blog by an anonymous user who also released proof-of-concept exploit code for it.

"The vulnerability allows an attacker, who has valid login to the installed product, to craft a SQL Injection Attack via a specific URL query parameter against any product page that updates database information," WHMCS said in a security advisory.

Obtaining a valid log-in for a WHMCS deployment isn't hard and just requires registering a new account using the application's register.php page, according to the user who disclosed the flaw.

The exploit can be used to obtain information about existing accounts, including their hashed passwords, which can result in the compromise of the administrator account.

WHMCS is popular among Web hosting providers because it integrates with many other tools and services like control panels, payment gateways, SSL certificate providers, VPS providers, domain registrars and more. The software can handle operations like payment processing, invoicing, automated account termination or suspension, support email management and others.

Web hosting providers are frequently targeted by attackers, because a compromise of their servers or systems can result in unauthorized access to hundreds or thousands of websites.

There have been many incidents of attackers exploiting vulnerabilities in hosting control panels like cPanel or Plesk, so it's possible that this critical vulnerability in WHMCS might see widespread exploitation as well.

Website optimization and security firm CloudFlare created a ruleset for its Web Application Firewall (WAF) to protect customers against attacks trying to exploit the new vulnerability.

"Hosting partners running their WHMCS behind CloudFlare's WAF can enable the WHMCS Ruleset and implement best practices to be fully protected from the attack," the company said in a blog post. However, customers should apply the newly released patches for their version of WHMCS or update their installations in order to close the vulnerability.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags WHMCSintrusiononline safetysecurityCloudFlareExploits / vulnerabilities

Featured

Slideshows

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Examining the changing job scene in the Kiwi channel

Examining the changing job scene in the Kiwi channel

Typically, the New Year brings new opportunities for personnel within the Kiwi channel. 2017 started no differently, with a host of appointments, departures and reshuffles across vendor, distributor and reseller businesses. As a result, the job scene across New Zealand has changed - here’s a run down of who is working where in the year ahead…

Examining the changing job scene in the Kiwi channel
​What are the top 10 tech trends for New Zealand in 2017?

​What are the top 10 tech trends for New Zealand in 2017?

Digital Transformation (DX) has been a critical topic for business over the last few years and IDC is now predicting a step change as DX reaches macroeconomic levels. By 2020 a DX economy will emerge and it will become the core of what New Zealand industries focus on. From the board level through to the C-Suite, Kiwi organisations must be prepared to think and act digital when the DX economy emerges in 2017.

​What are the top 10 tech trends for New Zealand in 2017?
Show Comments