Web hosting firms at risk from critical vulnerability in WHMCS billing and support system

WHMCS developers released security updates to close publicly disclosed SQL injection vulnerability

The developers of WHMCS, a popular client management, billing and support application for Web hosting providers, released emergency security updates Thursday to patch a critical vulnerability that was publicly disclosed.

The vulnerability enables attackers to execute SQL injection attacks against WHMCS deployments in order to extract or modify sensitive information from their databases.

U.K.-based WHMCS, released versions 5.2.8 and 5.1.10 of the software to fix the flaw, as well as incremental patches that can be applied manually to older versions without performing a full upgrade.

The SQL injection vulnerability was disclosed Thursday on a blog by an anonymous user who also released proof-of-concept exploit code for it.

"The vulnerability allows an attacker, who has valid login to the installed product, to craft a SQL Injection Attack via a specific URL query parameter against any product page that updates database information," WHMCS said in a security advisory.

Obtaining a valid log-in for a WHMCS deployment isn't hard and just requires registering a new account using the application's register.php page, according to the user who disclosed the flaw.

The exploit can be used to obtain information about existing accounts, including their hashed passwords, which can result in the compromise of the administrator account.

WHMCS is popular among Web hosting providers because it integrates with many other tools and services like control panels, payment gateways, SSL certificate providers, VPS providers, domain registrars and more. The software can handle operations like payment processing, invoicing, automated account termination or suspension, support email management and others.

Web hosting providers are frequently targeted by attackers, because a compromise of their servers or systems can result in unauthorized access to hundreds or thousands of websites.

There have been many incidents of attackers exploiting vulnerabilities in hosting control panels like cPanel or Plesk, so it's possible that this critical vulnerability in WHMCS might see widespread exploitation as well.

Website optimization and security firm CloudFlare created a ruleset for its Web Application Firewall (WAF) to protect customers against attacks trying to exploit the new vulnerability.

"Hosting partners running their WHMCS behind CloudFlare's WAF can enable the WHMCS Ruleset and implement best practices to be fully protected from the attack," the company said in a blog post. However, customers should apply the newly released patches for their version of WHMCS or update their installations in order to close the vulnerability.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityonline safetyintrusionExploits / vulnerabilitiesCloudFlareWHMCS

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?