Twitter     Facebook
Hosting Discussion

forgot password?



  Post #1 (permalink)   01-21-2014, 08:39 AM
HD Amateur
Join Date: Sep 2013
Location: leeds
Posts: 66

Status: nigelb is offline
WHMCS Security Advisory TSR-2014-0001

WHMCS has released a new update for all supported versions of WHMCS. These
updates contain changes that address security concerns within the WHMCS

We recommend you update your WHMCS installation(s) as soon as possible.

WHMCS has rated this update as having an important security impact. Information
on security ratings can be found at

Please update your installation to the one of the following versions:

== Patches ==

Incremental patches can be downloaded by following the provided links below.
These patch sets contain only the files that have changed between the previous
release and this update. The previous release version that these patch sets are
designed for is clearly indicated as the first and smaller number.

The following incremental patches are available for direct download:

5.2.15 --> 5.2.16
MD5 Checksum: 706e352796e91c4f27a40470c83125b8

To apply a patch set release, download the files as indicated above. Then follow
the upgrade instructions for a "Patch Set" which can be found at

== Full Release ==

A full release distribution contains all the files of a WHMCS product
installation. It can be used to perform a new install or update an existing
installation (regardless of previous version).

5.2.16 - Downloadable from the WHMCS Members Area
MD5 Checksum: fe2a804ade2bfd69d4107ff8aa1b718b

To apply a full release, download the files as indicated above. Then follow the
upgrade instructions for a "Full Release Version" which can be found

Important Maintenance Issue Information

This Advisory provides resolution for the following important maintenance

Case #2557 - 2Checkout Gateway: Update to currency variable
Case #2623 - Fix calculations of promotions when more than 50% off
Case #2739 - Add TLD Specific Fields required for .CN domain registrations
Case #2874 - Echeck: Fix capture function behaving incorrectly
Case #3019 - Refine internal criteria for bulk domain lookup
Case #3030 - Resolve SQL error in Income by Product Report
Case #3086 - Nominet Registrar: Update to Contact Registration Logic for
Case #3116 - Required Custom Fields not validating correctly when using API
Case #3360 - Resolved issue where one time promotions could be treated as
Case #3360 - Disable Recur For input box when Recurring is disabled
Case #3361 - Fix time limited recurring promotions calculating incorrectly
Case #3388 - Fix Invalid Token Error when applying credit in Original and
Portal Client Templates
Case #3414 - Payflow Pro: Update to store PayFlow Reference in PayFlow Mode
Case #3617 - Do not CC password reset emails to sub-accounts
Case #3740 - ProtX VSP Form: Pass correct callback values to debug log
Case #3801 - Resolved PDF Quotes missing clients name/address
Case #3802 - Make a quantity of zero remove item from the cart
Case #3809 - Regular Expression Custom Field Validation failing on single
Case #3811 - Resolve Invalid Token error when deleting recurring calendar
Case #3814 - Improvements to IPv6 detection and validation logic
Case #3862 - NameCheap Registrar: Fix incorrect function name call
Case #3864 - Echeck: Fix storage of bank account details
Case #3893 - Enom SSL Module: Fix Province is Required Error Message

Security Issue Information

This Advisory provides resolution for several security issues, all of which were
either reported privately via the Security Bounty Program or found internally by
the WHMCS Development team as part of the regular on-going internal security

There is no reason to believe that any of these vulnerabilities are known to the
public. As such, WHMCS will only release limited information about the
vulnerabilities at this time.

Once sufficient time has passed, WHMCS will release additional information about
the nature of the security issues.

Case #3637 - Improve Access Controls in Project Management Addon
Case #3782 - Improve Access Controls in Tickets
Case #3783 - Improve Access Controls in Invoices
Case #3784 - Resolve Admin Area SQL Injection Vulnerability
Case #3839 - Resolve Potential XSS Vulnerability
Case #3841 - Resolve Potential XSS Vulnerability
Case #3842 - Resolve Potential XSS Vulnerability
Case #3843 - Resolve Potential XSS Vulnerability
Case #3846 - Improve Access Controls in Tickets
Case #3922 - PayPal Express Checkout Improve Validation
Case #3931 - Potential header injection via whois lookups
Case #3932 - Improve sanitization for whois query

All supported versions of WHMCS are affected by one or more of these maintenance
and security issues.

For information regarding our Long Term Support Policy, read our documentation


WHMCS Limited

Thread Tools

New Post New Post   Old Post Old Post
Posting Rules:
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On