AES_ENCRYPT to Database backup?

[doc8179]

I had an attempted AES_ENCRYPT hack,

First Name: 'n403' to 'AES_ENCRYPT(1,1), firstname=(SELECT GROUP_CONCAT(id,0x3a,username,0x3a,email,0x3a,password SEPARATOR 0x2c20) FROM tbladmins)'

Default Payment Method: '' to ''

 

I'm running the latest version, and all I read about this seems to indicate the problem had been patched awhile back.

 

However, in the logs i noted this

 

Created Client n403 fghjkhgfd - User ID: 18

- 02/05/2014 17:11 - System - 2.90.243.165

Cron Job: Starting Database Backup

- 02/05/2014 01:56 - System -

Cron Job: Completed

 

2.90.243.165 is his IP address,

if I am reading this correctly, he was able to trigger a database backup?

Was he able to obtain a copy?!?!

[JFOC]

There was fix for this vuln

http://blog.whmcs.com/?t=79427

[doc8179]

I'm clear there was a fix... many versions ago..

I'm running 5.3.6

 

"

 

WHMCS Security Advisory for 5.x

Tweet

 

WHMCS has released new patches for the 5.2 and 5.1 minor releases. These updates provide targeted changes to address security concerns with the WHMCS product. You are highly encouraged to update immediately.

 

WHMCS has rated these updates as having critical security impacts. Information on security ratings is available at http://docs.whmcs.com/Security_Levels.

 

 

Releases

The following patch release versions of WHMCS have been published to address a specific SQL Injection vulnerability:

v5.2.8

v5.1.10"

 

So my question is.. with the current version, does that log say what I think it does, that this attack was able to backup my database and he was able to get a copy?

[searley]

In your example the db backup is several hours away from the time stamp on the new user, leading me the think the db backup was done as part if the daily cron

[doc8179]

In your example the db backup is several hours away from the time stamp on the new user, leading me the think the db backup was done as part if the daily cron

 

hmmm

 

does appear that way - had to enter in the detailed "view all"

 

02/05/2014 17:11

Created Client n403 fghjkhgfd - User ID: 18

System 2.90.243.165

02/05/2014 01:56

Cron Job: Starting Database Backup

System

02/05/2014 01:56

Cron Job: Completed

System

 

Thank you for pointing that out !