Support 
WHMCS Security Advisory for V4.5 & Google Checkout Users
- Monday, 3rd December, 2012
- 04:22am
WHMCS Security Advisory for V4.5 & Google Checkout Users
Releases
The following WHMCS versions address all known vulnerabilities:
> 4.5.3 for the 4.5 series
> 5.1.3 for the 5.1 series
The latest public releases of WHMCS are available inside our members area @ www.whmcs.com/members/clientarea.php
Security Issue Information
The 4.5 series update addresses a vulnerability that can permit a malicious user to decieve a WHMCS installation into crediting a payment that is sent to a PayPal account other than the account configured within that WHMCS installation. The 5.x series is unaffected by this vulnerability. It is only possible to exploit this vulnerability if the paypal module has been activated.
The rating for this vulnerability is: important
The 4.5 and 5.1 series update addresses a vulnerability that can permit a malicious user to inject SQL via the Google Checkout module. This only becomes possible to exploit if the Google Checkout module has been activated within the WHMCS installation and so non Google Checkout users are not at risk from this.
The rating for this vulnerability is: critical
Mitigation
Download and apply the appropriate patch file to protect against these vulnerabilities.
For the 4.5 series, please use the file: http://go.whmcs.com/42/v452patch
For the 5.1 series, please use the file: http://go.whmcs.com/46/v512googlecheckoutpatch
To apply the patch, simply download the appropriate patch file from above depending upon the WHMCS version you are running, extract the contents, and upload the files from the /whmcs/ folder to your installation.
No install or upgrade process is required.
* An email notification is being sent to all active license holders regarding this patch.
Releases
The following WHMCS versions address all known vulnerabilities:
> 4.5.3 for the 4.5 series
> 5.1.3 for the 5.1 series
The latest public releases of WHMCS are available inside our members area @ www.whmcs.com/members/clientarea.php
Security Issue Information
The 4.5 series update addresses a vulnerability that can permit a malicious user to decieve a WHMCS installation into crediting a payment that is sent to a PayPal account other than the account configured within that WHMCS installation. The 5.x series is unaffected by this vulnerability. It is only possible to exploit this vulnerability if the paypal module has been activated.
The rating for this vulnerability is: important
The 4.5 and 5.1 series update addresses a vulnerability that can permit a malicious user to inject SQL via the Google Checkout module. This only becomes possible to exploit if the Google Checkout module has been activated within the WHMCS installation and so non Google Checkout users are not at risk from this.
The rating for this vulnerability is: critical
Mitigation
Download and apply the appropriate patch file to protect against these vulnerabilities.
For the 4.5 series, please use the file: http://go.whmcs.com/42/v452patch
For the 5.1 series, please use the file: http://go.whmcs.com/46/v512googlecheckoutpatch
To apply the patch, simply download the appropriate patch file from above depending upon the WHMCS version you are running, extract the contents, and upload the files from the /whmcs/ folder to your installation.
No install or upgrade process is required.
* An email notification is being sent to all active license holders regarding this patch.
Powered by WHMCompleteSolution
