(Quote)

Just in, and somewhat related.

(Quote)

It's the root password you set during the order process for your VPS which is sent in clear text. It's not the account password. And most of the people know, that WHMCS does this. People who use their

Well. F*ck WHMCS then, we should collectively sue them for storing this sensitive data in plain text.

(Quote)

If i am not mistaken, WHMCS uses BCRYPT so, the password hashes are useless?

Hi @iNanja -- appreciate you placing an order with RackNerd! We've activated your FREE Clientexec license.

(Quote)

do i must put all my 9x ordered number to get Free Clientexec license? (Image)

I had those fields in WHMCS. I used stripe. The fields were not populated as a result of using the stripe module. Unless he used the old school way of storing cards and his own merchant account, shoul

(Quote)

Don't know what the password is, I know it's not important to me. Didn't reuse passwords then, I was under pretty constant attack during those days. Nothing of value in the WHMCS account but one or tw

(Quote)

https://www.ndchost.com/wiki/software/whmcs/client-password-hash

It is common practice with most secure apps and being a whmcs plugin developer myself. You encrypt the password with a key(salt) and the salt is stored away from and in a different medium to where the

(Quote)

Can anyone confirm? How are passwords of servers (root) stored in WHMCS? Are they in clear?

Def a legit whmcs tblclients table leak. I bet the client notes column will be quite interesting. Mine says “a fuck chargeback”. Long time ago now but if I remember I placed an order which they did no

As for "security perspective": You are very lucky if you get some sakkurity with WHMCS and the other PHP and javascript crap and that's not HS specific.