Skyline Servers

OK if it's part of v6 installation I agree it does make sense to remove it then, but a questions came up... If the file isn't needed anymore shouldn't it be deleted with v7 update? sounds like that would be good practice and would prevent this also If file wouldn't be in needed/used at all it wouldn't be called on dashboard page load and caused an error in the dashboard in the first place right so common sense just dictates that this file is loaded by something and is used by WHMCS v7 installations since the dashboard breaks with it in place because of that old function there. I mean having random php script placed in widgets shouldn't render dashboard unusable right. Oh wait but it does. I just tested this and any PHP script uploaded to modules/widget is being executed on dashboard render (possibly other pages?) thus making it possible to break it or even possibly cause other malicious actions like take over admin privileges, perform actions as admin if the script we put there is executed as admin user viewing the dashboard anything we add there will be executed as well. Offcourse it first must be possible to place such script into WHMCS installation modules/widget directory, but if we keep in mind that WHMCS now has autoupdates that require web server user to have to write permission to WHMCS site code directory for updates to happen so this possibility might not be so far fetched, some web server misconfiguration or setup mistakes could allow for uploading a file to the server in some cases.

Hello, I am Dawid and operate https://skylineservers.com offering web hosting and linux server support services. I am new on the community, however, have been using WHMCS system for few years. What I am looking for on this community is to share expertise and learn from other fellow WHMCS users.

It would be good to know which module this file comes from. A bit safer fix than completly removing system_overview.php is commenting the function causing the issue widget_system_overview_home_banner() much like so: /*function widget_system_overview_home_banner() { $roleid = Admin::getRoleID(); $widgets = get_query_val("tbladminroles","widgets",array("id"=>$roleid)); $widgets = explode(',',$widgets); $banner = (in_array('system_overview',$widgets)) ? '<div id="sysoverviewbanner"><div style="margin:0;padding: 10px;background-color: #FBEEEB;border: 1px dashed #cc0000;font-weight: bold;color: #cc0000;font-size:14px;text-align: center;"><img src="images/loading.gif" /></div></div>' : ''; return $banner; }*/ add_hook("AdminHomeWidgets",1,"widget_system_overview"); //add_hook("AdminHomepage",1,"widget_system_overview_home_banner"); and hopefully, next update will overwrite the file and fix it the broken function.