Menu
Web hosting firms at risk from critical vulnerability in WHMCS billing and support system

Web hosting firms at risk from critical vulnerability in WHMCS billing and support system

WHMCS developers released security updates to close publicly disclosed SQL injection vulnerability

The developers of WHMCS, a popular client management, billing and support application for Web hosting providers, released emergency security updates Thursday to patch a critical vulnerability that was publicly disclosed.

The vulnerability enables attackers to execute SQL injection attacks against WHMCS deployments in order to extract or modify sensitive information from their databases.

U.K.-based WHMCS, released versions 5.2.8 and 5.1.10 of the software to fix the flaw, as well as incremental patches that can be applied manually to older versions without performing a full upgrade.

The SQL injection vulnerability was disclosed Thursday on a blog by an anonymous user who also released proof-of-concept exploit code for it.

"The vulnerability allows an attacker, who has valid login to the installed product, to craft a SQL Injection Attack via a specific URL query parameter against any product page that updates database information," WHMCS said in a security advisory.

Obtaining a valid log-in for a WHMCS deployment isn't hard and just requires registering a new account using the application's register.php page, according to the user who disclosed the flaw.

The exploit can be used to obtain information about existing accounts, including their hashed passwords, which can result in the compromise of the administrator account.

WHMCS is popular among Web hosting providers because it integrates with many other tools and services like control panels, payment gateways, SSL certificate providers, VPS providers, domain registrars and more. The software can handle operations like payment processing, invoicing, automated account termination or suspension, support email management and others.

Web hosting providers are frequently targeted by attackers, because a compromise of their servers or systems can result in unauthorized access to hundreds or thousands of websites.

There have been many incidents of attackers exploiting vulnerabilities in hosting control panels like cPanel or Plesk, so it's possible that this critical vulnerability in WHMCS might see widespread exploitation as well.

Website optimization and security firm CloudFlare created a ruleset for its Web Application Firewall (WAF) to protect customers against attacks trying to exploit the new vulnerability.

"Hosting partners running their WHMCS behind CloudFlare's WAF can enable the WHMCS Ruleset and implement best practices to be fully protected from the attack," the company said in a blog post. However, customers should apply the newly released patches for their version of WHMCS or update their installations in order to close the vulnerability.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags online safetyintrusionExploits / vulnerabilitiesCloudFlareWHMCS

Featured

Slideshows

Reseller News Platinum Club celebrates leading partners in 2019

Reseller News Platinum Club celebrates leading partners in 2019

The leading players of the New Zealand channel came together to celebrate a year of achievement at the annual Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months.

Reseller News Platinum Club celebrates leading partners in 2019
Reseller News hosts alumnae breakfast for Women in ICT Awards

Reseller News hosts alumnae breakfast for Women in ICT Awards

Reseller News hosted its second annual alumnae breakfast for the Women in ICT Awards in New Zealand, designed to showcase the leading female leaders in the industry. Held at The Cordis in Auckland, attendees came together to hear inspiring keynotes and panel discussions, alongside high-level networking among peers. Photos by Gino Demeer.

Reseller News hosts alumnae breakfast for Women in ICT Awards
Reseller News Innovation Awards 2019: meet the winners

Reseller News Innovation Awards 2019: meet the winners

Reseller News honoured the standout players of the New Zealand channel in front of more than 480 technology leaders in Auckland on 23 October, recognising the achievements of top partners, emerging entrants and innovative start-ups.

Reseller News Innovation Awards 2019: meet the winners
Show Comments