Jump to content

Blocking Malicious Email Attempts in Tickets


davet

Recommended Posts

About 5-6 times daily someone (always from different a IP) opens a sales ticket with code similar to the following within the body of the message:

 

{php}eval(base64_decode

 

I block and delete the ticket but they just keep submitting sales tickets with different input strings and from different IPs.

 

I understand they are trying to hack into my site. Is this something I need to worry about?

 

I've seen the attempts increase within the last month. I've never had this problem before. Is there any way to prevent them from submitting the ticket at all if they are including things like "{php}eval(base64" within the ticket?

Edited by bear
No need to post the actual exploit, yet again
Link to comment
Share on other sites

About 5-6 times daily someone (always from different a IP) opens a sales ticket with code similar to the following within the body of the message:

 

{php}eval(base64_decode

 

I block and delete the ticket but they just keep submitting sales tickets with different input strings and from different IPs.

 

I understand they are trying to hack into my site. Is this something I need to worry about?

 

I've seen the attempts increase within the last month. I've never had this problem before. Is there any way to prevent them from submitting the ticket at all if they are including things like "{php}eval(base64" within the ticket?

 

 

Im getting the same issue and I patched when it came out and have been told it fixes this problem but now its just becoming a bother. I get several tickets a day with this attempt. Its just plane annoying and its sad because I got 3 emails on Christmas with this attack. Its sad that people don't have anything else better to do. I hope WHMCS comes out with a patch just to prevent tickets from being opened with this patched exploit.

Link to comment
Share on other sites

Hey I got it just block it go to WHMCS and then Setup >> Support >> Spam control and paste {php}eval(base64_decode and block it as phrase.

 

Does not work with tickets created by submitting a form. Install the patch and you are safe anyway. If you dont want to see the tickets, just create a hook to stop them.

 

/includes/hooks/stophack.php :

{REMOVED]

Edited by WHMCS Andrew
Removing code
Link to comment
Share on other sites

Also got 2 hacking attempts via ticket (base64) - from Devil Iraq and red virus (... yea right)

 

Installed the latest patch - fingers crossed they can't get in...

 

If you have had hacking attempts before you applied the patch you should take all actions you can to make sure you are safe.

Link to comment
Share on other sites

  • 3 weeks later...
Does not work with tickets created by submitting a form. Install the patch and you are safe anyway. If you dont want to see the tickets, just create a hook to stop them.

 

/includes/hooks/stophack.php :

[REMOVED]

 

Hm, for some reason I can't save my email templates if I enable this hook, anyone know away around that?

 

/Tommy

Edited by WHMCS Andrew
Removing code
Link to comment
Share on other sites

I guess your email templates must contain that code. You can rename the hook file extension temporarily to .php.bak to disable it when you need to edit the email templates, and once you finish editing just rename the file extension back to .php

Link to comment
Share on other sites

I guess your email templates must contain that code. You can rename the hook file extension temporarily to .php.bak to disable it when you need to edit the email templates, and once you finish editing just rename the file extension back to .php

 

No,

 

You can't edit any email templates when using that actionhook.

 

Here's a "stock WHMCS template" which got caught by the hook and the error was displayed:

 

 

 

<p>Dear {$client_name},</p>
<p>You requested that you be reminded of your Client Area Login Details. They are as follows:</p>
<p>Email Address: {$client_email} <br /> Password: {$client_password}</p>
<p>You can login at {$whmcs_url}</p>
<p>{$signature}</p>

Link to comment
Share on other sites

  • 4 weeks later...
Do you think that just disabling the ability to submit tickets without an account will work for that?

 

You wouldn't want to require registration for Sales tickets. We have customers now that complain they have to login to open Support and Billing tickets. I can't imagine how many potential customers we'd upset if we had to require registration just to contact us with Sales questions.

Link to comment
Share on other sites

You wouldn't want to require registration for Sales tickets. We have customers now that complain they have to login to open Support and Billing tickets. I can't imagine how many potential customers we'd upset if we had to require registration just to contact us with Sales questions.

WOW that is bad. I have no doubt that this the case with many of customers. I didn't really think about that part of the equation.

 

I wish they could get better captcha to help thwart the robots.

Link to comment
Share on other sites

  • 2 weeks later...

No it wont. Just had someone from Algiers open a new ticket with this by using a combination of upper and lower case characters for "eval": {php}evaL(base64_decode(

 

Anyway, easily solved by replacing strpos with stripos which does case insensitive comparisons.

 

[REMOVED]

Edited by WHMCS Andrew
Removing code
Link to comment
Share on other sites

  • WHMCS Developer
I wish they could get better captcha to help thwart the robots.

 

Unfortunately even with Google reCaptcha enabled these tickets are being submitted as it is someone actually submitting the ticket, and not a robot.

 

From our side, we would not advise you use that code as it does stop some other page submissions from working. The code isn't being executed and is not causing any harm to your WHMCS. You can just delete the tickets.

Link to comment
Share on other sites

  • 1 month later...

Unfortunately i dont believe that any captcha alone is going to solve the problem. Many professionals i have spoke with believe that captcha was outdated the day after it was released and many captcha's have been defeated, some quite easily.

 

This link was given to me by a wordpress guru on the WP support thread. It shows captcha's that have been defeated. http://caca.zoy.org/wiki/PWNtcha

 

So if it is a bot doing this which i believe it is some kind of sniffer myself just looking for holes, i think the best solution is to come up with an anti bot question in addition to the captcha.

 

Nothing is fool proof from my experience but i know that as soon as i added an anti bot question to some of my other sites, alot of the BS stopped, at least it put a dent in it.

 

It would be nice to not even get this base64 message, i get it to. But i have been assured it has been taked care of in my version which i installed in feb ver 5.03 and receiveng the message is just an annoyance, i am been assured it is not harming me.

 

I hope for a better solution myself to avoid even seeing it.

Edited by durangod
Link to comment
Share on other sites

  • 2 months later...

I have had ENOUGH damage done to my business from this hacking exploit already!

I don't like seeing the "php_eval" mails just because it reminds me of all my lost business. It doesn't seem too much to ask the WHMCS development team to come up with a block to keep these mails OUT OF my ticket system!

 

How about it? Please come out with instructions on how we can do this ourselves if nothing else.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use & Guidelines and understand your posts will initially be pre-moderated