info@fsit.ch Posted October 3, 2013 Share Posted October 3, 2013 Oh. Oh. Oh. This is... beyond bad. /includes/dbfunctions.php: **EXPLOIT REMOVED** What's this? If the SQL update has a value that starts with AES_ENCRYPT it must be totally legal and trusted and why the **************** should we db_escape_string() it? Speechless. Link to comment Share on other sites More sharing options...
No-Server Posted October 3, 2013 Share Posted October 3, 2013 (edited) Screenshot to not spread the kiddy-ready-exploit-python-file. **EXPLOIT REMOVED** Doesn't look too good! - - - Updated - - - Just for the information: It was posted about 20-30 minutes ago from this time. - - - Updated - - - You should take your complete WHMCS installation offline for now. For the not-so-technical people: It allows you to run ANY MySQL statement on your installation. So yes, you can fetch everything from the database you want to. Edited October 3, 2013 by No-Server Link to comment Share on other sites More sharing options...
wsa Posted October 3, 2013 Share Posted October 3, 2013 Someone already post this http://forum.whmcs.com/showthread.php?79422-EXPLOIT-FOR-5-2-7!-Take-care-immediately! Link to comment Share on other sites More sharing options...
twhiting9275 Posted October 3, 2013 Share Posted October 3, 2013 ugh, I'm getting sick and tired here of these vulnerabilities and issues. Come on, people, get professional auditing! <edit> While you're at it... QUIT using mysql_crap . it's going away Link to comment Share on other sites More sharing options...
andy40 Posted October 3, 2013 Share Posted October 3, 2013 Hi is this just 5.2.7 or older ones to ? Link to comment Share on other sites More sharing options...
andy40 Posted October 3, 2013 Share Posted October 3, 2013 Hi is this just 5.2.7 or older ones to ? Link to comment Share on other sites More sharing options...
No-Server Posted October 3, 2013 Share Posted October 3, 2013 I've not tested it. The guy who found it explicit wrote 5.2.7. Link to comment Share on other sites More sharing options...
twhiting9275 Posted October 3, 2013 Share Posted October 3, 2013 given this specific exploit, I'd say it's a safe assumption that every version of WHMCS is involved. Link to comment Share on other sites More sharing options...
No-Server Posted October 3, 2013 Share Posted October 3, 2013 On the other thread they mentioned it could work with every version. But no one knows for sure yet. Link to comment Share on other sites More sharing options...
twhiting9275 Posted October 3, 2013 Share Posted October 3, 2013 this is in dbfunctions, and this specific bit of code really isn't that version specific. Of course I could be wrong, but I'd lay good odds that this is not just 5.27 , but every version of whmcs that utilizes dbfunctions. Oddly enough, this is a simple fix, unless there's something else in there, I'm surprised they haven't fixed it and released it yet Link to comment Share on other sites More sharing options...
bear Posted October 3, 2013 Share Posted October 3, 2013 Replying to subscribe. Link to comment Share on other sites More sharing options...
nationhost Posted October 3, 2013 Share Posted October 3, 2013 We've pulled our WHMCS installation, i just hope it won't take long to patch Link to comment Share on other sites More sharing options...
twhiting9275 Posted October 3, 2013 Share Posted October 3, 2013 Hi guys, you don't need to remove your WHMCS installs. Here's how to fix this WITHOUT doing so: Inside of your WHMCS install directory (in ssh) chmod a-xrw includes/dbfunctions.php This will deny WHMCS from writing, or reading dbfunctions, and cause the system to just abort OR from ssh again: chmod a-xrw "whmcsdirectoryhere" Both work Link to comment Share on other sites More sharing options...
DontForget Posted October 3, 2013 Share Posted October 3, 2013 when the patch will be pushed to all? I see that conference is much more important than fixing security holes. Link to comment Share on other sites More sharing options...
kahless2k Posted October 3, 2013 Share Posted October 3, 2013 Replying to subscribe Link to comment Share on other sites More sharing options...
earthgirl Posted October 3, 2013 Share Posted October 3, 2013 @twhiting9275 You mean this will cause the system to abort for hack attempts only? Sorry, not my strong area clearly. What does this mean for the end user? Thanks! Hi guys,you don't need to remove your WHMCS installs. Here's how to fix this WITHOUT doing so: Inside of your WHMCS install directory (in ssh) chmod a-xrw includes/dbfunctions.php This will deny WHMCS from writing, or reading dbfunctions, and cause the system to just abort OR from ssh again: chmod a-xrw "whmcsdirectoryhere" Both work Link to comment Share on other sites More sharing options...
yourweb Posted October 3, 2013 Share Posted October 3, 2013 Replying to subscribe FYI: In Thread tools you can subscribe without posting. 1 Link to comment Share on other sites More sharing options...
SeanP Posted October 3, 2013 Share Posted October 3, 2013 Has a ticket been opened? They may not see the forum post for a while... Link to comment Share on other sites More sharing options...
yourweb Posted October 3, 2013 Share Posted October 3, 2013 According to twitter they are working on it: Link to comment Share on other sites More sharing options...
paperweight Posted October 3, 2013 Share Posted October 3, 2013 they just pushed out a fix: http://blog.whmcs.com/?t=79427 Link to comment Share on other sites More sharing options...
evotz Posted October 3, 2013 Share Posted October 3, 2013 No fix for 5.1? Is 5.1 not vulnerable then? Link to comment Share on other sites More sharing options...
Daniel Posted October 3, 2013 Share Posted October 3, 2013 Latest tweet: We've released a patch for our 5.2.x branch and will be publishing one for 5.1.x shortly. Link to comment Share on other sites More sharing options...
WHMCS Brian Posted October 3, 2013 Share Posted October 3, 2013 Howdy All, We've been working diligently to get the security patches for this issue out the door. As it's already been noted, we've gotten the first set of patches out. The 5.1 patches are being worked on as this post is being written. We will update this thread, the blog and Twitter then the 5.1 patches are ready. http://blog.whmcs.com/ https://twitter.com/whmcs Thank you so much for your patience. Link to comment Share on other sites More sharing options...
WHMCS Brian Posted October 3, 2013 Share Posted October 3, 2013 Howdy All, We have made an update to our recent blog post to publish an incremental release to the 5.1 series. Please take a look at our blog for more information: http://blog.whmcs.com/ Link to comment Share on other sites More sharing options...
Recommended Posts