Menu
Web hosting firms at risk from critical vulnerability in WHMCS billing and support system

Web hosting firms at risk from critical vulnerability in WHMCS billing and support system

WHMCS developers released security updates to close publicly disclosed SQL injection vulnerability

The developers of WHMCS, a popular client management, billing and support application for Web hosting providers, released emergency security updates Thursday to patch a critical vulnerability that was publicly disclosed.

The vulnerability enables attackers to execute SQL injection attacks against WHMCS deployments in order to extract or modify sensitive information from their databases.

U.K.-based WHMCS, released versions 5.2.8 and 5.1.10 of the software to fix the flaw, as well as incremental patches that can be applied manually to older versions without performing a full upgrade.

The SQL injection vulnerability was disclosed Thursday on a blog by an anonymous user who also released proof-of-concept exploit code for it.

"The vulnerability allows an attacker, who has valid login to the installed product, to craft a SQL Injection Attack via a specific URL query parameter against any product page that updates database information," WHMCS said in a security advisory.

Obtaining a valid log-in for a WHMCS deployment isn't hard and just requires registering a new account using the application's register.php page, according to the user who disclosed the flaw.

The exploit can be used to obtain information about existing accounts, including their hashed passwords, which can result in the compromise of the administrator account.

WHMCS is popular among Web hosting providers because it integrates with many other tools and services like control panels, payment gateways, SSL certificate providers, VPS providers, domain registrars and more. The software can handle operations like payment processing, invoicing, automated account termination or suspension, support email management and others.

Web hosting providers are frequently targeted by attackers, because a compromise of their servers or systems can result in unauthorized access to hundreds or thousands of websites.

There have been many incidents of attackers exploiting vulnerabilities in hosting control panels like cPanel or Plesk, so it's possible that this critical vulnerability in WHMCS might see widespread exploitation as well.

Website optimization and security firm CloudFlare created a ruleset for its Web Application Firewall (WAF) to protect customers against attacks trying to exploit the new vulnerability.

"Hosting partners running their WHMCS behind CloudFlare's WAF can enable the WHMCS Ruleset and implement best practices to be fully protected from the attack," the company said in a blog post. However, customers should apply the newly released patches for their version of WHMCS or update their installations in order to close the vulnerability.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags WHMCSintrusiononline safetysecurityCloudFlareExploits / vulnerabilities

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments