All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Woha this guy aint giving up
MrRapidHost
Member
Maybe some of you have heard of him his called Cyber4rt, that's like the 3rd try and he always fails.
He signs up, then change his address and information with sql statements trying to gain access to the billing system and servers.
First Name: 'Aganteng' to 'Andri'
Last Name: 'Rooterz' to 'Cyber4rt'
Address 1: 'dm' to 'AES_ENCRYPT(1,1), address1= (SELECT MIN(username) FROM tbladmins)'
Address 2: 'dm' to 'AES_ENCRYPT(1,1), address2= (SELECT MIN(password) FROM tbladmins)'
City: 'dm' to 'AES_ENCRYPT(1,1), city= (SELECT MAX(username) FROM tbladmins)'
State: 'Arizona' to 'AES_ENCRYPT(1,1), state= (SELECT MAX(password) FROM tbladmins)'
Postcode: '404404' to '40404'
Default Payment Method: '' to ''
If you are unhappy with any of the changes, you need to login and revert them - this is the only record of the old details.
This change request was submitted from vps-1118555-13724.manage.myhosting.com (216.224.162.45)
Comments
This is why you use my free proxy / vpn check service , it's 100% free I don't even run any ads.
He'll have a blast when WHMCS 6.0 is out..
Yea, probably.
Current WHMCS is patched, but who knows it's always good to take the necessary precautions.
Meh. This is just a skid trying to use a long-patched vulnerability. Only thing blocking them is going to accomplish, is cleaning up your logs slightly
Welcome to my world, bud.
As long as your whmcs is updated to the last version there is nothing to worry about
.
Eh, happens from time to time.
Makes me wonder what entices script kiddies these days.
I blame the wealth of people who STILL have WHMCS versions that haven't been updated since 2011. It's pathetically sad that people follow the "if it doesn't appear broken to me, I shouldn't bother updating it" attitude to the internet. If I had a dollar for every customer at a previous job who said to me "It's been working fine for years and I haven't touched it, why are your servers not secure?" after a compromise.... I'd probably have a down payment for a house.
Why would someone want to check if someone is using a VPN? I use a VPN all the time just as a matter of principle.
Yes I've tripped on the stupid fraud screening some companies use because I happened to be VPN'd to one of my existing servers when I placed the order. (Needed to access something on that network and had forgotten to disconnect the VPN when done)
Also you'd also sometimes see me come from behind a proxy, although that said it's configured to reveal the source IP and it's not trying to hide the fact it's a proxy.
After seeing that Name, Andri, it's just make me sad.
That's Indonesian name with fake location (probably using vpn/proxy)
We get 10-15 of them a month... I tend to just ban the IP and delete the account...
If I used WHMCS (thankfully I have my own software which doesn't have gaping holes like that - yes, self promotion, get over it), I'd just setup a "retard" filter that looks for those, then to screw with them I'd send a random output each time to make it look like the exploit worked. Might as well have fun screwing with the "hackers"
Better get working on that April Fools module, eh?
First Name: 'Aganteng'
And @FlamesRunner's pic says sangnewbieabadi on the email... sigh
Unfortunately true. That, and various other dangerous and ignorant statements, including but not limited to:
... and so on, and so on, and so on...
Here you go...
https://github.com/KuJoe/chkProxy
https://github.com/KuJoe/chkClientDetails
True, but it could do more like preventing fraud. It's free so it's worth looking into.
Hrm. While it might reduce the fraud rate, checking for VPNs/proxies is still a rather rudimentary approach... either way, it certainly won't do anything useful against this particular phenomenon
Isn't that like super old (the exploit)?
Yes it is, very old... and yet we get one of those "clients" at least once per week, sometimes even more often... of course they all don't pass the fraud checks, but they still change details like crazy
Maybe it's some automated script the person uses. Otherwise if its manual the failure rate must be high.