WHMCompleteSolution Unspecified SQL Injection Vulnerability

Bugtraq ID:	53770
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 04 2012 12:00AM
Updated:	Jun 04 2012 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	WHMCS WHMCS 5.0.2 WHMCS WHMCS 4.5.2 WHMCS WHMCS 4.4.2 WHMCS WHMCS 4.3.1 WHMCS WHMCS 4.2.1 WHMCS WHMCS 4.1.2 WHMCS WHMCS 4.0.1 WHMCS WHMCS 5.0 WHMCS WHMCS 4.2 WHMCS WHMCompleteSolution 4.5
Not Vulnerable:

WHMCompleteSolution Unspecified SQL Injection Vulnerability

WHMCompleteSolution is prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The vendor has addressed this issue in WHMCompleteSolution versions 4.0 and later.

WHMCompleteSolution Unspecified SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

WHMCompleteSolution Unspecified SQL Injection Vulnerability

Solution:
Vendor patch is available. Please see the references for more information.

WHMCompleteSolution Unspecified SQL Injection Vulnerability

References:

• Security Patch Release (WHMCS)
  
• WHMCompleteSolution Homepage (Whmcs)
  
• WHMCompleteSolution Security Patch (WHMCS)