webKami

Sorry had to fix your message befor it makes sense. I have explained it before, I am not describing how they got in. There is a lot to it, besides staying quiet about a vulnerability hurts more. As I shared what I did some nice people shared more tips and it all helps making a securer system. Edit: just realised you might just be quoting the original message and with some smiley (invisible), my message stands for the original commenter.

Good points in there, I am putting this up in the OP so it can be more visible. P.S. Actually where is my edit button for OP?

This is class and hilarious, however in all seriousness could mean whoever is trying the hack might get pissed off and keep your IP on their list to try something else in future. I would just display error 500 or white screen of death.

I appreciate your concerns however I have not explained how to hack it. I have briefly detailed signs of a hacked system. This way you can identify if your system is hacked. My main post is about how to cleanup after such an event. Rest assured nobody can hack WHMCS by just reading this post, besides that issue is fixed in patch and I am just raising awareness.

Got Hacked? If you see an unauthorized admin login in your WHMCS install, or your WHMCS installs starts behaving all funny, the chances are your installation has been compromised. I got hacked, what to do? For one of our clients, an attack happened before they could apply the recent security patch (version 4.5.2) Looking through files I can see that the attack happened by upload of a PHP file attached with a ticket. It then carried on to add code (an uploader) to config file, which in turn then uploaded few scripts in templates_c. Beyond that it tried and wrote a few malicious script in other directories on the domain. I also noticed there were a few zip files that had malware in it. Looking at all this you can say the main purpose is to inject malicious code in your website and install malware on your visitor's machines. Here are cleanup steps we took after having word of advice from WHMCS & our hosting support. Start with a cool mind, do not panic. Take the backup of whole system if possible and put that aside. Take the DB backup, download and test it by importing in local MySQL. Untested backup is not considered backup. In other sub-folders hunt and delete recently written malicious files or unknown zip files. Take the files backup, move it to a folder above public_html / httpdocs Upload a fresh copy of WHMCS of same version or later Clean your infected config file, there will be two obvious sections in it. Leave the first section that only has values in it. Delete the later section that has base64 encrypted or any other code in it. If unsure just create a new config file with same old DB values. Do your regular upgrading steps (changing name of admin folder, setting permissions etc) Finally browse to /admin (or renamed folder). If you have uploaded a newer version it should upgrade Install this security patch: http://forum.whmcs.com/showthread.php?p=206522 If you want to copy your template / lang or any other file from infected folder do manually check each file (specially files with new timestamp) to remeove any malicious code before copying. Change all passwords, including but not limited to admin, super admin, hosting, mysql, email. You will have to update your config once you change MySQL password. Above is a very rough list of what I did, your list might differ but main points are to make sure all files are fresh or cleaned. I hope this information helps somebody else. Feel free to ask any questions here.