whmcs security.

[Rehost24]

Hello. I noticed in my whmcs that bots are gaining access to old inactive user accounts and are being authorized. Where can I find the problem? All new accounts that are after 2024 are protected there or there is no attack there.

Please give me recommendations on how this can be done

[Rehost24]

I'll also add that I'm using the latest version of whmcs.

[WHMCS Ricardo]

Hey! Are you using reCAPTCHA v3?

https://docs.whmcs.com/8-13/system/system-tutorials/enable-recaptcha-v3/

 

[Rehost24]

Yes, I have it installed. But I'm wondering if passwords are being hacked and how they access client accounts. ?

[RadWebHosting]

It's possible that there was exposure to the older passwords. I would recommend exercising an abundance of caution, especially if the accounts are associated with active clients. Force all your active clients to reset passwords (force password difficulty to high level), and permanently disable or remove dormant/inactive accounts while you investigate further to determine the root cause of this behavior.

 

[Rehost24]

Yes, I understand. I've already forced the user to change their passwords, but I'm just curious. Could some database have been leaked? Or is it that easy to guess the password and email?

[Rehost24]

.

Edited September 22 by Rehost24

[WHMCS JoshQ]

Hi @Rehost24,

There are lots of possible causes.

Indeed, compromise is one of those, and that is particularly likely if WHMCS is hosted in a shared environment.

I'd recommend reviewing our Enhancing Security guide:
https://docs.whmcs.com/8-13/installation-guide/initial-configuration/enhancing-security/

Beyond that, it would be worth consulting with a System Administrator or Security Specialist who can take a look at your installation and identify any possible weak points.

Just to further the advice given above, it is possible to force all clients to reset their passwords by removing the stored password hashes from the databases:
https://help.whmcs.com/m/managing/l/1535126-forcing-a-password-reset

UPDATE `tblusers` SET `password` = '', `email_verification_token_expiry` = NULL, `email_verified_at` = NULL, `reset_token_expiry` = NULL WHERE 1;

Of course, you should then send an e-mail to all clients instructing them to reset their password using the standard Forgot Password flow.

Hope this helps.