WHMCS Select Attempts

Comments

• adxn Member, Host Rep

  February 2015

  Maybe it is a XSS Attack!
• wych Member

  February 2015 edited February 2015

  Yep but not as often, I'm sure its one of the older WHMCS exploits.
• agoldenberg Member, Host Rep

  February 2015

  Yeah I never had this happen before. A couple days ago I started seeing them. Looked around for a exploit but I think it's safe for now.
• Ndha Member

  February 2015

  perhaps you mean like this @agoldenberg ??
  
  if this true, i had 10 times and now it's gone
  
  an old exploit from 2013 http://blog.whmcs.com/?t=79527
  

  Client ID: 216 - Miger Zone has requested to change his/her details as indicated below:
  
  Address 1: 'cyber' to 'AES_ENCRYPT(1,1), address1= (SELECT MIN(type) FROM tblservers)'
  Address 2: 'team' to 'AES_ENCRYPT(1,1), address2= (SELECT MIN(ipaddress) FROM tblservers)'
  City: 'miger' to 'AES_ENCRYPT(1,1), city= (SELECT MIN(username) FROM tblservers)'
  State: 'CA' to 'AES_ENCRYPT(1,1), state= (SELECT MIN(accesshash) FROM tblservers)'
  Default Payment Method: '' to ''
  If you are unhappy with any of the changes, you need to login and revert them - this is the only record of the old details.
  
  This change request was submitted from tus.tusdns.com (198.154.252.3)
• agoldenberg Member, Host Rep

  February 2015

  @ndha yeah that's exactly it.

  Thanked by 1Ndha
• adxn Member, Host Rep

  February 2015

  

  Just got this mail from my WHMCS!
• vpsGOD Member, Host Rep

  February 2015

  @adxn second client attacker.
• adxn Member, Host Rep

  February 2015

  suraj4u said: @adxn second client attacker.

  Yep! It is just a brand new WHMCS!
• KuJoe Member, Host Rep

  February 2015 edited February 2015

  Decided to throw together a WHMCS hook for this so here you go: https://github.com/KuJoe/chkClientDetails

  EDIT: @agoldenberg in case you don't get a notification that I replied to the thread.

  Thanked by 4adxn ndelaespada PremiumN Ndha
• PremiumN Member

  February 2015

  @KuJoe said:
  Decided to throw together a WHMCS hook for this so here you go: https://github.com/KuJoe/chkClientDetails

  Interesting. It'll be more interesting if the error messages would have something that will p*** the person off.
• KuJoe Member, Host Rep

  February 2015

  @PremiumN said:
  Interesting. It'll be more interesting if the error messages would have something that will p*** the person off.

  You can change the error message if you want, I like to keep it neutral just to be safe.
• nexmark Member

  February 2015

  @KuJoe said:
  Decided to throw together a WHMCS hook for this so here you go: https://github.com/KuJoe/chkClientDetails

  EDIT: agoldenberg in case you don't get a notification that I replied to the thread.

  This should be in WHMCS by default
• gestiondbi Member, Host Rep

  February 2015

  @nexmark said:
  This should be in WHMCS by default

  @KuJoe , I agree wit nexmark, Why not contact Whmcs to propose your work?

  Thanked by 1KuJoe