New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
We patched to 5.2.9 it's seem all fine hopefully that's can really fixed the Vulnerability
Glad they got this done in time for the script kiddie shift on the other side of the world where most of these wankers seem to live.
If you live in the western hemisphere, the you are right, eastern hemisphere population outnumber western hemisphere one 6:1, so, even if there are proportionally less script kiddies there due to high cost of internet and computers in most places, chances are they outnumber the ones in the western hemisphere.
Apparently Matt does sleep well knowing his software is broken.
If Matt would have just posted that instead of the "Active Development" and "LTS" stuff, it would have actually been a useful post.
Sorry if I sound a bit harsh, but really, this has happened way too many times already.
Yeah you'd think after the 20th time they would just contact an outside firm to do a code audit like SolusVM did. This is kind of ridiculous...
Many people didnt trust solus being serious about the audit. However, solus has a lot of serious OS contenders out there and many people are also coding their own, therefore they had a very good incentive to better themselves fast, competition for WHMCS is not that big so they can still sit on their hands for now, I am sure nobody canceled their subscription and that is unlikely to happen anytime soon, so, good or bad, whmcs does not need to do anything for now against hostbill which cant even select a price to sell the product at...
WHMCS SHAME!!!
They are working on release a new version of WHMCS on this Christmas with full of bugs and security HOLES!!
Mod_sec is a great thing but you have to put in a lot of hours to perfect it.
Had to have one of our 24 hour support staff keep monitoring WHMCS's blog for the update then call my phone to wake me up so I could apply the fix. Glad I decided to go down that route instead of waiting till 4:30am
Most people sleep well with a company profit of well over 200k GBP / year
viewtickets.php was only an example, this can be used on basically any page
i think http://www.dedicatedminds.com/billing as been exploited...
why is there billing on 404 @Jack
They took it down to avoid the hack?
@Jack yep 403....
This is getting ridiculous. It also seems to happen when I am away for a day or two. It's a shame there is not a viable security focused/open source alternative to WHMCS.
Is anyone up for a provider mailing list just for WHMCS/SOLUS exploits?
This assumes an attack disclosed by localhost.re
All the latest ones have been.
We denied access to the directory to prevent any possible breach. This happened as soon as the exploit went into circulation.
Everything is back online now, thanks to WHMCS for the patch though it was quite early in the morning and typically after I went to bed so it was delayed a little.
@CVPS_Chris Any news when access to billing/client area will be back? There is no way to manage vps without it. Most of other providers are already patched whmcs
@Jack
"We have found a security issue in the WHMCS system"
They don't provide solus access, since June
@sman "my pet and me" we
Sadly this "security fix" has broken the mass mail feature, verified with others as well it does not list all clients.
Good thing I don't mass mail the clients.