WHMCompleteSolution Google Checkout Module SQL Injection

by Carol~ Moderator - 1/4/13 9:14 AM

In Reply to: VULNERABILITIES / FIXES - January 04, 2013 by Carol~ Moderator

WHMCompleteSolution Google Checkout Module SQL Injection Vulnerability

Release Date : 2013-01-04

Criticality level : Less critical
Impact: Manipulation of data
Where : From remote
Solution Status : Vendor Patch

Software: WHMCompleteSolution 5.x

Description:
A vulnerability has been reported in WHMCompleteSolution, which can be exploited by malicious users to conduct SQL injection attacks.

Certain input passed to the Google checkout module is not properly sanitised before being used in a SQL query.

The vulnerability is reported in versions prior to 5.1.3.

Solution:
Update to version 5.1.3 or apply patch.

Original Advisory:
http://blog.whmcs.com/index.php?t=64778
http://forum.whmcs.com/showthread.php?64778-Security-Advisory-for-V4-5-amp-Google-Checkout-Users

http://secunia.com/advisories/51719/