WHMCS Security Advisory TSR-2014-0001

WHMCS has released a new update for all supported versions of WHMCS. These updates contain changes that address security concerns within the WHMCS product.

We recommend you update your WHMCS installation(s) as soon as possible.

WHMCS has rated this update as having an important security impact. Information on security ratings can be found at http://docs.whmcs.com/Security_Levels

Releases
Please update your installation to the one of the following versions:
v5.2.16

Patches – What is a Patch?

Incremental patches can be downloaded by following the provided links below. These patch sets contain only the files that have changed between the previous release and this update. The previous release version that these patch sets are designed for is clearly indicated as the first and smaller number.

The following incremental patches are available for direct download:
5.2.15 –> 5.2.16 http://go.whmcs.com/298/v5215_incremental_to_v5216_patch
MD5 Checksum: 706e352796e91c4f27a40470c83125b8

To apply a patch set release, download the files as indicated above. Then follow the upgrade instructions for a “Patch Set” which can be found at http://docs.whmcs.com/Upgrading#For_a_Patch_Set

Full Release – What is a Full Release?

A full release distribution contains all the files of a WHMCS product installation. It can be used to perform a new install or update an existing installation (regardless of previous version).
5.2.16 – Downloadable from the WHMCS Members Area
MD5 Checksum: fe2a804ade2bfd69d4107ff8aa1b718b

To apply a full release, download the files as indicated above. Then follow the upgrade instructions for a “Full Release Version” which can be found at http://docs.whmcs.com/Upgrading#For_a_Full_Release_Version

Important Maintenance Issue Information

This Advisory provides resolution for the following important maintenance issues:
Case #2557 – 2Checkout Gateway: Update to currency variable
Case #2623 – Fix calculations of promotions when more than 50% off
Case #2739 – Add TLD Specific Fields required for .CN domain registrations
Case #2874 – Authorize.net Echeck: Fix capture function behaving incorrectly
Case #3019 – Refine internal criteria for bulk domain lookup
Case #3030 – Resolve SQL error in Income by Product Report
Case #3086 – Nominet Registrar: Update to Contact Registration Logic for Individuals
Case #3116 – Required Custom Fields not validating correctly when using API
Case #3360 – Resolved issue where one time promotions could be treated as recurring
Case #3360 – Disable Recur For input box when Recurring is disabled
Case #3361 – Fix time limited recurring promotions calculating incorrectly
Case #3388 – Fix Invalid Token Error when applying credit in Original and Portal Client Templates
Case #3414 – Payflow Pro: Update to store PayFlow Reference in PayFlow Mode
Case #3617 – Do not CC password reset emails to sub-accounts
Case #3740 – ProtX VSP Form: Pass correct callback values to debug log
Case #3801 – Resolved PDF Quotes missing clients name/address
Case #3802 – Make a quantity of zero remove item from the cart
Case #3809 – Regular Expression Custom Field Validation failing on single quotes
Case #3811 – Resolve Invalid Token error when deleting recurring calendar entry
Case #3814 – Improvements to IPv6 detection and validation logic
Case #3862 – NameCheap Registrar: Fix incorrect function name call
Case #3864 – Authorize.net Echeck: Fix storage of bank account details
Case #3893 – Enom SSL Module: Fix Province is Required Error Message
Case #3922 – PayPal Express: Remove auto-login from Express Checkout Module

Security Issue Information

This Advisory provides resolution for several security issues, all of which were either reported privately via the Security Bounty Program or found internally by the WHMCS Development team as part of the regular on-going internal security audits.

There is no reason to believe that any of these vulnerabilities are known to the public. As such, WHMCS will only release limited information about the vulnerabilities at this time.

Once sufficient time has passed, WHMCS will release additional information about the nature of the security issues.
Case #3637 – Improve Access Controls in Project Management Addon
Case #3782 – Improve Access Controls in Tickets
Case #3783 – Improve Access Controls in Invoices
Case #3784 – Resolve Admin Area SQL Injection Vulnerability
Case #3839 – Resolve Potential XSS Vulnerability
Case #3841 – Resolve Potential XSS Vulnerability
Case #3842 – Resolve Potential XSS Vulnerability
Case #3843 – Resolve Potential XSS Vulnerability
Case #3846 – Improve Access Controls in Tickets
Case #3922 – PayPal Express Checkout Improve Validation
Case #3931 – Potential header injection via whois lookups
Case #3932 – Improve sanitization for whois query

All supported versions of WHMCS are affected by one or more of these maintenance and security issues.

For information regarding our Long Term Support Policy, read our documentation here:
http://docs.whmcs.com/Long_Term_Support