eval(base64_decode

[WebyHosting]

Hi,

Users constantly register and send me this code in WHMCS:

 

1)

{php}eval(base64_decode
<<removed>>

 

Any solution?

Edited December 18, 2011 by bear
posting exploit code

[Eduardo G.]

I'm answering you here, too

 

First, check you have applied specific patch:

http://forum.whmcs.com/showthread.php?t=43462

 

Then you can take a look at this post about spam control rules to avoid those tickets:

http://forum.whmcs.com/showpost.php?p=207853&postcount=3

(full thread: http://forum.whmcs.com/showthread.php?p=207853#post207853)

[m8internet]

Then you can take a look at this post about spam control rules to avoid those tickets

The spam controls do not work, as the support ticket is not submitted by email

[Eduardo G.]

The spam controls do not work, as the support ticket is not submitted by email

Didn't know, thanks!

[easyhosting]

Hi,

Users constantly register and send me this code in WHMCS:

 

<code removed>

 

Any solution?

 

 

this has been mentioned in several forums and we have been informed many times DO NOT list the code

[ominetworks]

No patch for this issue ?? !!!

[TommyK]

Yes, of course there is.

[FlexiHost]

@ominetworks please visit http://forum.whmcs.com/showthread.php?t=43462

[Jbro]

You are already hacked. Please hurry.

[Pipey]

@ominetworks please visit http://forum.whmcs.com/showthread.php?t=43462

 

I applied the appropriate patch on the day it was issued but have received atleast 4 of these spams since. Please advise.

[FlexiHost]

You will still get the messages through, unless you have a hook setup to just ditch them.

 

If you have patch then you should have nothing to worry about.

[mylove4life]

what does the code really do? So incase we can look out for it..

[bear]

All sorts of things, usually by first uploading a shell script into one of the writable directories. Several different payloads have been mentioned, but generally that's first.

[mylove4life]

Thanks Bear, just got one of the emails myself tonight, I used this to decode it

 

http://www.opinionatedgeek.com/dotnet/tools/Base64Decode/Default.aspx

 

I thought I had the patch anyway but was not sure, I do not see anything wrong and all my directories are non default, so I should be ok.....

[croc]

I happen to be one of little understanding. I did replace the file with the patched file but I have no idea what a hook is or how to make one. Can I get more info please?

 

Thanks

 

 

 

You will still get the messages through, unless you have a hook setup to just ditch them.

 

If you have patch then you should have nothing to worry about.

[bear]

I happen to be one of little understanding. I did replace the file with the patched file but I have no idea what a hook is or how to make one. Can I get more info please?

 

This explains hooks: http://docs.whmcs.com/Action_Hooks

Once you've read that, ask any questions you might have.

[croc]

Thanks for the link. I read the info and I am still confused.

 

Can you tell me what a "hook" would look like to stop the spam referred to here?

 

Thanks

[bear]

Matt posted this elsewhere, so I take no credit for it.

Create a brand new php file, and call it whatever you like, in this folder: whmcs/includes/hooks

In it:

<?php
$checkvars = array('subject','message');
foreach ($checkvars AS $checkvar) if (strpos($_REQUEST[$checkvar],'{php}')!==false) die("no thanks");
?>

If a message comes in with that subject or message, it should offer a blank page with "no thanks" on it. Edit to suit.

[SilverNodashi]

Matt posted this elsewhere, so I take no credit for it.

Create a brand new php file, and call it whatever you like, in this folder: whmcs/includes/hooks

In it:

<?php
$checkvars = array('subject','message');
foreach ($checkvars AS $checkvar) if (strpos($_REQUEST[$checkvar],'{php}')!==false) die("no thanks");
?>

If a message comes in with that subject or message, it should offer a blank page with "no thanks" on it. Edit to suit.

 

This "extra" also blocks you (WHMCS administrator) from editing any email templates.

This, and every other template I tried to edit was blocked:

 

<p>Dear {$client_name},</p>
<p>You requested that you be reminded of your Client Area Login Details. They are as follows:</p>
<p>Email Address: {$client_email} <br /> Password: {$client_password}</p>
<p>You can login at {$whmcs_url}</p>
<p>{$signature}</p>

[wsa]

That true any idea

[zomex]

The spam controls do not work, as the support ticket is not submitted by email

 

This is true, on webhostingtalk.com someone post a very good hook that stops people being able to use {php} in tickets. It's a shame that spam controls wasn't able to achieve this.