terryfagen Posted February 12, 2012 Share Posted February 12, 2012 (edited) As above and now well documented, the exploit is processed manually, so cannot be processed as spam What you end up receiving is the normal email from a new support ticket or sales enquiry I have tested and applied the "text exclude" script and this works perfectly well If a new support ticket is submitted then a message appears Although rather basic, it works *REMOVED* Save as : evalblock.php in the folder : /includes/hooks/ I note the script has 'message' but only works on the subject line, and this is good enough (for just now) You can repeat this same script for other words and phrases, just give each a unique filename Hello, I am no expert so can you please explain what this code does? Does it search for a specific work in the subject of the email? I would like to add a specific sequence of characters to the end of a valid ticket, in the subject field. I would like WHMCS to reject all new tickets that do not contain this code. Thanks, Terry Edited February 23, 2012 by WHMCS Andrew Code Removed 0 Quote Link to comment Share on other sites More sharing options...
m8internet Posted February 12, 2012 Share Posted February 12, 2012 if you do this you will find this also block you from doing certain things f rom within your Admin area, scuh as creating or amending email templates. I have not encountered any issues and received the warning message whilst making amendments and/or changes in the Admin Area If I did, then it shows the script is working, so changes can be performed at the MySQL database instead 0 Quote Link to comment Share on other sites More sharing options...
easyhosting Posted February 12, 2012 Share Posted February 12, 2012 I have not encountered any issues and received the warning message whilst making amendments and/or changes in the Admin Area If I did, then it shows the script is working, so changes can be performed at the MySQL database instead This is what i was told by Matt Hi Terry, This error message you're seeing is coming from a hook file you have created @ /public_html/clients/includes/hooks/evalblock.php designed to protect against the submissions for the issue we patched last year. It's really unecessary to do that as the patch will protect you from it, and attackers will have started giving up trying it now so I recommend you simply delete that, but if you want to keep it you just need to temporarily remove it from the folder when editing your email templates. Regards, Matt ------- Forums: http://forums.whmcs.com/ Documentation: http://docs.whmcs.com/ 0 Quote Link to comment Share on other sites More sharing options...
elysed Posted February 21, 2012 Share Posted February 21, 2012 Setting the tickets to only visible to existing clients have helped me on spam tickets. 0 Quote Link to comment Share on other sites More sharing options...
easyhosting Posted February 21, 2012 Share Posted February 21, 2012 Setting the tickets to only visible to existing clients have helped me on spam tickets. so what do you do if a prospective client tries to send a ticket with some pre sales questions? 0 Quote Link to comment Share on other sites More sharing options...
msaunders Posted February 22, 2012 Share Posted February 22, 2012 Tried the workaround above (includes/hook) and it works great but I found when I created a new KB article and went to save it , I got the "Error - Invalid Subject Line" warning so it looks like this hook is running when saving / creating KB articles also? 0 Quote Link to comment Share on other sites More sharing options...
easyhosting Posted February 22, 2012 Share Posted February 22, 2012 (edited) Tried the workaround above (includes/hook) and it works great but I found when I created a new KB article and went to save it , I got the "Error - Invalid Subject Line" warning so it looks like this hook is running when saving / creating KB articles also? yes it messes up other areas. this is what i got from Matt Hi Terry, This error message you're seeing is coming from a hook file you have created @ /public_html/clients/includes/hooks/evalblock.php designed to protect against the submissions for the issue we patched last year. It's really unecessary to do that as the patch will protect you from it, and attackers will have started giving up trying it now so I recommend you simply delete that, but if you want to keep it you just need to temporarily remove it from the folder when editing your email templates. Regards, Matt Edited February 22, 2012 by easyhosting 0 Quote Link to comment Share on other sites More sharing options...
msaunders Posted February 22, 2012 Share Posted February 22, 2012 yeah i seen that . I removed the hook but I got another php injection attempt last night . I just get the shudders when it happens , you dont know if the f***ers have found another way to get in ! 0 Quote Link to comment Share on other sites More sharing options...
easyhosting Posted February 22, 2012 Share Posted February 22, 2012 yeah i seen that . I removed the hook but I got another php injection attempt last night . I just get the shudders when it happens , you dont know if the f***ers have found another way to get in ! i know i get 3 yesterday from the same IP, even though blocked the IP in WHMCS. i used to also report these to the email address in a whois search of the IP, but some of these are fake emails as emails bounce back as unknown address. 0 Quote Link to comment Share on other sites More sharing options...
tripler Posted February 22, 2012 Share Posted February 22, 2012 if your using cPanel you can try spam assassin, I believe you can set WHMCS to reject the emails SA marks as ***SPAM*** ... you may have to look this up, not sure. Disable auto delete and keep an eye on the spam folder just in case. 0 Quote Link to comment Share on other sites More sharing options...
bear Posted February 22, 2012 Share Posted February 22, 2012 if your using cPanel you can try spam assassin, I believe you can set WHMCS to reject the emails SA marks as ***SPAM*** ... you may have to look this up, not sure. Disable auto delete and keep an eye on the spam folder just in case. This won't help with anything but the emails generated *after* the ticket is submitted. They're being done manually, not via email. 0 Quote Link to comment Share on other sites More sharing options...
tripler Posted February 22, 2012 Share Posted February 22, 2012 DUH, Was not even thinking about that logic, 11am is early =\ 0 Quote Link to comment Share on other sites More sharing options...
HawtDogFlvrwtr Posted July 27, 2012 Share Posted July 27, 2012 If anyone is interested. We are building an addon that leverages AKISMET spam detection when a user submits a ticket. If you want to be one of the 10 beta testers, reply to this thread. http://forum.whmcs.com/showthread.php?53118-WHMCS-Ticket-Spam-Control-*AKISMET*-%28Need-Beta-Testers%29 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.