WHMCS Multiple SQL Injection and Cross Site Request Forgery Vulnerabilities
BID:64533
Info
WHMCS Multiple SQL Injection and Cross Site Request Forgery Vulnerabilities
| Bugtraq ID: | 64533 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 12 2013 12:00AM |
| Updated: | Dec 12 2013 12:00AM |
| Credit: | AhwAk20o0 |
| Vulnerable: |
WHMCS WHMCS 5.1 WHMCS WHMCS 5.0 WHMCS WHMCS 4.2 |
| Not Vulnerable: | |
Discussion
WHMCS Multiple SQL Injection and Cross Site Request Forgery Vulnerabilities
WHMCS is prone to multiple SQL-injection vulnerabilities and a cross-site request forgery vulnerability.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or perform certain unauthorized actions in the context of the affected application. This may lead to other vulnerabilities.
WHMCS 4.x and 5.x are vulnerable; other versions may also be affected.
WHMCS is prone to multiple SQL-injection vulnerabilities and a cross-site request forgery vulnerability.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or perform certain unauthorized actions in the context of the affected application. This may lead to other vulnerabilities.
WHMCS 4.x and 5.x are vulnerable; other versions may also be affected.
Exploit / POC
WHMCS Multiple SQL Injection and Cross Site Request Forgery Vulnerabilities
Attackers can use a browser to exploit these issue. To exploit the cross-site request-forgery vulnerability, the attacker must entice an unsuspecting victim to visit a specially-crafted webpage.
The following exploit is available:
Attackers can use a browser to exploit these issue. To exploit the cross-site request-forgery vulnerability, the attacker must entice an unsuspecting victim to visit a specially-crafted webpage.
The following exploit is available:
Solution / Fix
WHMCS Multiple SQL Injection and Cross Site Request Forgery Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
WHMCS Multiple SQL Injection and Cross Site Request Forgery Vulnerabilities
References:
References:
- WHMCS Homepage (WHMCS)