October 04, 2013, 10:29 AM — The developers of WHMCS, a popular client management, billing and support application for Web hosting providers, released emergency security updates Thursday to patch a critical vulnerability that was publicly disclosed.
The vulnerability enables attackers to execute SQL injection attacks against WHMCS deployments in order to extract or modify sensitive information from their databases.
U.K.-based WHMCS, released versions 5.2.8 and 5.1.10 of the software to fix the flaw, as well as incremental patches that can be applied manually to older versions without performing a full upgrade.
The SQL injection vulnerability was disclosed Thursday on a blog by an anonymous user who also released proof-of-concept exploit code for it.
"The vulnerability allows an attacker, who has valid login to the installed product, to craft a SQL Injection Attack via a specific URL query parameter against any product page that updates database information," WHMCS said in a security advisory.
Obtaining a valid log-in for a WHMCS deployment isn't hard and just requires registering a new account using the application's register.php page, according to the user who disclosed the flaw.
The exploit can be used to obtain information about existing accounts, including their hashed passwords, which can result in the compromise of the administrator account.
WHMCS is popular among Web hosting providers because it integrates with many other tools and services like control panels, payment gateways, SSL certificate providers, VPS providers, domain registrars and more. The software can handle operations like payment processing, invoicing, automated account termination or suspension, support email management and others.
Web hosting providers are frequently targeted by attackers, because a compromise of their servers or systems can result in unauthorized access to hundreds or thousands of websites.
There have been many incidents of attackers exploiting vulnerabilities in hosting control panels like cPanel or Plesk, so it's possible that this critical vulnerability in WHMCS might see widespread exploitation as well.
Website optimization and security firm CloudFlare created a ruleset for its Web Application Firewall (WAF) to protect customers against attacks trying to exploit the new vulnerability.
"Hosting partners running their WHMCS behind CloudFlare's WAF can enable the WHMCS Ruleset and implement best practices to be fully protected from the attack," the company said in a blog post. However, customers should apply the newly released patches for their version of WHMCS or update their installations in order to close the vulnerability.