WHMCS Multiple Security Vulnerabilities

Bugtraq ID:	63572
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Nov 07 2013 12:00AM
Updated:	Nov 07 2013 12:00AM
Credit:	localhost.re, the vendor, Vlad C of NetSec Interactive and an individual
Vulnerable:
Not Vulnerable:

WHMCS Multiple Security Vulnerabilities

WHMCS is prone to following security vulnerabilities:

1. An SQL-injection vulnerability
2. A directory-traversal vulnerability
3. An information-disclosure vulnerability
4. An HTTP-header-injection vulnerability
5. A security-bypass vulnerability

An attacker can exploit these issues to download arbitrary files in the context of the web server process, bypass certain security restrictions, gain access to sensitive information, insert arbitrary headers into an HTTP response, launch HTTP-response-splitting attacks, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

WHMCS Multiple Security Vulnerabilities

Attackers can exploit these issues using a browser.

WHMCS Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

WHMCS Multiple Security Vulnerabilities

References: