WHMCS V3.7.1 Sensible Information Disclosure



Software: WHMCS V3.7.1
Complete Name: WHM Complete Solution Version 3.7.1
Bug: Information Disclosure

Website of the Software: http://www.whmcs.com/


Author: Julian A. Rodriguez
Contact: julianrdz91@xxxxxxxxx


Review:

An attacker can obtain very sensible information about the server
just typing the next path : /status/index.php?action=phpinfo
You can enter to this folder/file without any kind of security test
or some authorization. You can get information about the versions
of the software, the kernel version, the operating system, the
commands that you can use inside the server, you can see if the
safe mode of the server is on/off, you can grab information
about the server administrator too, the path of the server root,
and a lot of more information about the server.

Proof of Concept:
http://www.xxxxxxxx.net/status/index.php?action=phpinfo

Note:
In the demo of the site whmcs.com you can't enter to this section because
the files have been deleted for security reasons.


--
Julian A. Rodriguez
Website: http://www.nulledcore.com



Relevant Pages

  • Enable Bandwidth throttling programmatically using WMI in C#
    ... Does anybody has the script to add Bandwidth throttling and Website ... public string IPAddress ... /// Gets or sets the name of the IIS server that site ... ManagementObject ...
    (microsoft.public.win32.programmer.wmi)
  • Re: Permission Problems SBS2003 R1
    ... website on the SBS server? ... Default permissions and user rights for IIS 6.0 ... Step 3: Please check the permissions in IIS manager: ... Step 4: Re-running CEICW on SBS server: ...
    (microsoft.public.windows.server.sbs)
  • 85010014 error - resolved - ActiveSync Exchange Server
    ... Application Log on our server would be filled with those ActiveSync 3005: ... It basically all comes down to the basics of Windows DNS, how SSL ... and our Default Website could only properly respond to ONE IP ... SSL host header using port 443 with our SSL cert. ...
    (microsoft.public.pocketpc.activesync)
  • 85010014 error - Exchange ActiveSync - Resolved
    ... Application Log on our server would be filled with those ActiveSync 3005: ... It basically all comes down to the basics of Windows DNS, how SSL ... and our Default Website could only properly respond to ONE IP ... SSL host header using port 443 with our SSL cert. ...
    (microsoft.public.exchange.connectivity)
  • Re: Basic Authentication + IIS 5 + Windows 2000 + Frontpage 2002 = failure?
    ... > By this, I mean, usually, on the basic logon screen of a server, I see ... >>;) under the website in question, enabling only Basic authentication. ... and can use the local administrator account to successfully ...
    (microsoft.public.inetserver.iis.security)